PT-2020-8905

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 4.7.3 Description The issue allows attackers to cause a denial of service, resulting in an application crash, by providing invalid LaTeX text. Recommendations For versions prior to 4.7.3, update to version...

CVE-2017-18914: Improper Check for Unusual or Exceptional Conditions

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist...

PT-2020-10846

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.8.0 Description An issue was discovered where the Mattermost Server does not honor the domain requirement when processing a join request for an open team. Recommendations For versions prior to 5.8.0, updat...

CVE-2020-14457: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the updateteam WebSocket event, aka MMSA-2020-0012...

PT-2020-8444

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.2.0 Mattermost Server version 4.1.1 Mattermost Server version 4.0.5 Description: An issue in Mattermost Server allows crafted posts to potentially cause a web browser to hang. Recommendations: For version...

PT-2020-8417

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.5.0 Mattermost Server version 4.4.5 Mattermost Server version 4.3.4 Mattermost Server version 4.2.2 Description: The issue allows attackers to cause a denial of service, resulting in an application crash,...

PT-2020-8897

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.1 Description An issue was discovered that allows an attacker to bypass intended access control for direct-message channel creation via the Message slash command. Recommendations For versions prior to 5.1,...

PT-2020-8893

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.2.2 Mattermost Server versions prior to 5.1.2 Mattermost Server versions prior to 4.10.4 Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, via...

CVE-2016-11063: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview...

PT-2020-8443

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.2.0 Mattermost Server version 4.1.1 Mattermost Server version 4.0.5 Description: The issue concerns Mattermost Server when used as an OAuth 2.0 service provider. It mishandles a deny action for a...

CVE-2018-21263: Improper Authentication

An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a different user's account via a crafted SAML response...

PT-2020-7994

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.3.0 Description: An issue was discovered that allows an attacker to use the WebSocket feature to send pop-up messages to users or change a post's appearance. Recommendations: For versions prior to 3.3.0,...

CVE-2019-20868: Improper Input Validation

An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated...

CVE-2017-18880: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the titlelink field of a Slack attachment...

CVE-2017-18898: Improper Resource Shutdown or Release

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts that potentially cause a web browser to hang...

PT-2020-8432

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: An issue was discovered in Mattermost Server that allows a bypass of restrictions on use of slash commands. Recommendations...

PT-2020-8008

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.0.0 Description: An issue in Mattermost Server allows XSS via a redirect URL. Recommendations: For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue...

CVE-2017-18872: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...

CVE-2019-20866: Inconsistent Interpretation of HTTP Requests

An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for obtaining IP address information was mishandled...

PT-2020-14008 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.23.0 Description: An issue allows attackers to cause a denial of service, specifically an infinite loop, by exploiting automatic direct message replies. Recommendations: For versions prior to 5.23.0, upda...