PT-2020-10841

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.9.0 Mattermost Server versions prior to 5.8.1 Mattermost Server versions prior to 5.7.3 Mattermost Server versions prior to 4.10.8 Description An issue was discovered where changes to e-mail addresses with...

PT-2020-8892

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.3.0 Description The issue is related to the mishandling of timing in the Mattermost Server. Recommendations For versions prior to 5.3.0, update to version 5.3.0 or later to resolve the issue...

PT-2020-8433

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: An issue was discovered in Mattermost Server that discloses the team creator's e-mail address to members. Recommendations:...

PT-2020-7995

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.2.0 Description: An issue was discovered in the Mattermost Server where the initial load API endpoint disclosed unnecessary personal information. Recommendations: For versions prior to 3.2.0, update to...

PT-2020-8446

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.1.0 Mattermost Server version 4.0.4 and earlier Mattermost Server version 3.10.3 and earlier Description: An issue allows CSV injection via a compliance report. Recommendations: For versions prior to 4.1....

PT-2020-7992

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.5.1 Description: An issue allows XSS to occur via file preview. Recommendations: For versions prior to 3.5.1, update to version 3.5.1 or later to resolve the issue...

PT-2020-7997

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.2.0 Description: An issue was discovered that allows attackers to read LDAP fields via injection. Recommendations: For versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue...

PT-2020-8001

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.0.2 Description: An issue was discovered where the purposes of a session ID and a Session Token were mishandled. Recommendations: For versions prior to 3.0.2, update to version 3.0.2 or later to resolve t...

PT-2020-8437

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.2.0 Mattermost Server version 4.1.1 Mattermost Server version 4.0.5 Description: An issue in Mattermost Server allows phishing because an error page can contain a link. Recommendations: For versions prior...

PT-2020-8462

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7 Description: The issue concerns API endpoint access control not honoring an integration permission restriction...

PT-2020-8458

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7 Description: An issue was discovered that allows an attacker to specify a full pathname of a log file...

PT-2020-8461

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7 Description: An issue was discovered in Mattermost Server. After a restart of a server, an attacker might suddenly...

PT-2020-8454

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.0.0 Mattermost Server version 3.10.2 Mattermost Server version 3.9.2 Description: An issue was discovered where a password-reset request could be sent to an attacker-provided e-mail address...

PT-2020-8452

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.0.0 Mattermost Server version 3.10.2 Mattermost Server version 3.9.2 Description: An issue was discovered when Single Sign-On OAuth2 is used, allowing an attacker to claim somebody else's account...

PT-2020-10817

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.17.0 Description An issue allows remote attackers to cause a denial of service, resulting in a client-side application crash, via a LaTeX message. Recommendations For versions prior to 5.17.0, update to...

CVE-2019-20844: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel...

CVE-2017-18875: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files...

CVE-2017-18904: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an uploaded file...

CVE-2019-20873: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user activation/deactivation...

CVE-2020-14452: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Mattermost Server before 5.21.0. mmctl allows directory traversal via HTTP, aka MMSA-2020-0014...