PT-2020-10844

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.8.0 Mattermost Server versions prior to 5.7.2 Mattermost Server versions prior to 5.6.5 Mattermost Server versions prior to 4.10.7 Description An issue in Mattermost Server allows attackers to cause a deni...

PT-2020-8459

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7 Description: An issue was discovered that allows XSS to occur via a link on an error page. Recommendations: For...

PT-2020-8451

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.0.0 Mattermost Server version 3.10.2 Mattermost Server version 3.9.2 Description: An issue was discovered in Mattermost Server when used as an OAuth 2.0 service provider, where session invalidation was...

CVE-2019-20890: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.7. It allows a bypass of e-mail address discovery restrictions...

PT-2020-10834

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.9.0 Mattermost Server versions prior to 5.8.1 Mattermost Server versions prior to 5.7.3 Mattermost Server versions prior to 4.10.8 Description An issue was discovered in the Markdown library, which allows...

PT-2020-8899

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.1 Description An issue in Mattermost Server allows attackers to bypass intended access restrictions for group-message channel creation via the Group message slash command. Recommendations For versions prio...

PT-2020-8903

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 4.8.1 Mattermost Server versions prior to 4.7.4 Mattermost Server versions prior to 4.6.3 Description An issue was discovered in Mattermost Server where WebSocket events were accidentally sent during certain...

PT-2020-8464

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.7.3 Mattermost Server versions prior to 3.6.5 Description: An issue was discovered in Mattermost Server. A System Administrator can place a SAML certificate at an arbitrary pathname. Recommendations: For...

CVE-2017-18909: Improper Certificate Validation

An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory...

PT-2020-8426

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: An issue was discovered in Mattermost Server. XSS could occur via the title link field of a Slack attachment...

PT-2020-8011

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 2.2.0 Description: An issue was discovered that allows XSS via a crafted link. Recommendations: For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue...

CVE-2017-18890: Improper Input Validation

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows an attacker to create a button that, when pressed by a user, launches an API request...

PT-2020-8002

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.0.0 Description: The issue allows for XSS attacks via a Legal or Support setting. This can be exploited to execute malicious scripts. Recommendations: For versions prior to 3.0.0, update to version 3.0.0 ...

CVE-2019-20859: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input...

PT-2020-8891

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.4.0 Description The issue concerns the mishandling of possession of superfluous authentication credentials. Recommendations For versions prior to 5.4.0, update to version 5.4.0 or later to resolve the issu...

PT-2020-8422

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: An issue was discovered in Mattermost Server when local storage for files is used, allowing a System Admin to test for the...

CVE-2018-21248: Insufficiently Protected Credentials

An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials...

PT-2020-10849

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.8.0 Description An issue was discovered where the software does not always generate a robots.txt file. Recommendations For versions prior to 5.8.0, update to version 5.8.0 or later to resolve the issue...

PT-2020-10848

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.8.0 Description An issue allows attackers to partially attach a file to more than one post. Recommendations For versions prior to 5.8.0, update to version 5.8.0 or later to resolve the issue...

PT-2020-14017 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.20.0 Description: An issue was discovered in Mattermost Server where non-members can receive broadcasted team details via the update team WebSocket event. Recommendations: For versions prior to 5.20.0,...