CVE-2017-18872: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...

CVE-2019-20866: Inconsistent Interpretation of HTTP Requests

An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for obtaining IP address information was mishandled...

PT-2020-14008 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.23.0 Description: An issue allows attackers to cause a denial of service, specifically an infinite loop, by exploiting automatic direct message replies. Recommendations: For versions prior to 5.23.0, upda...

PT-2020-8005

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.0.0 Description: The issue arises because the software does not ensure that a cookie is used over SSL. This could potentially expose sensitive information. Recommendations: For versions prior to 3.0.0,...

CVE-2019-20882: Incorrect Default Permissions

An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team...

PT-2020-8902

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 4.10.1 Mattermost Server versions prior to 4.9.4 Mattermost Server versions prior to 4.8.2 Description The issue allows attackers to cause a denial of service, resulting in an application hang, by utilizing ...

PT-2020-8898

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.1 Description An issue was discovered where non-members of a channel could use the "Channel PATCH API" to modify that channel. Recommendations For versions prior to 5.1, update to version 5.1 or later to...

PT-2020-10820

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.16.0 Description An issue allows attackers to cause a denial of service via many backtick characters, resulting in a markdown renderer hang. Recommendations For versions prior to 5.16.0, update to version...

CVE-2016-11078: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information credential fields within config.json via the System Console UI...

PT-2020-8450

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.0.0 Mattermost Server version 3.10.2 and earlier Mattermost Server version 3.9.2 and earlier Description: An issue allows XSS via an uploaded file. Recommendations: For versions prior to 4.0.0, update to...

PT-2020-14013 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.21.0 Description: An issue was discovered that allows attackers to cause a denial of service due to socket read operations not being appropriately restricted. Recommendations: For versions prior to 5.21.0...

CVE-2020-14447: Loop with Unreachable Exit Condition

An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0021...

PT-2020-8434

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: An issue was discovered in Mattermost Server that allows SQL injection during the fetching of multiple posts...

CVE-2016-11077: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account...

CVE-2017-18884: Improper Privilege Management

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens...

PT-2020-8423

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: An issue was discovered that allows XSS attacks to occur against an OAuth 2.0 allow/deny page. Recommendations: For version...

PT-2020-8465

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.7.0 Mattermost Server version 3.6.3 and earlier Description: An issue was discovered that allows attackers to use the API for unauthenticated team creation. Recommendations: For Mattermost Server versions...

CVE-2017-18882: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS can occur via OpenGraph data...

CVE-2019-20857: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.16.0. It allows attackers to cause a denial of service markdown renderer hang via many backtick characters...

CVE-2019-20874: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during a role change...