CVE-2017-18905: Insufficient Session Expiration

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled...

CVE-2017-18906: Improper Authentication

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account...

CVE-2017-18902: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover team invite IDs via team API endpoints...

CVE-2017-18900: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report...

CVE-2017-18870: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case...

CVE-2017-18917: Use of Password Hash With Insufficient Computational Effort

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens...

CVE-2018-21253: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use the invitepeople slash command to invite a non-permitted user...

CVE-2018-21249: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing...

CVE-2018-21261: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. An e-mail invite accidentally included the team inviteid, which leads to unintended excessive invitation privileges...

PT-2020-8449

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.0.0 Mattermost Server versions 3.10.2 and earlier Mattermost Server versions 3.9.2 and earlier Description: An issue allows CSRF to occur if CORS is enabled. Recommendations: For versions prior to 4.0.0,...

CVE-2019-20843: Improper Preservation of Permissions

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There are weak permissions for configuration files...

CVE-2019-20860: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service application hang via a crafted SVG document...

CVE-2019-20845: Allocation of Resources Without Limits or Throttling

An issue was discovered in Mattermost Server before 5.18.0. It allows attackers to cause a denial of service memory consumption via a large Slack import...

CVE-2019-20855: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information local files during legacy attachment migration...

CVE-2019-20880: Allocation of Resources Without Limits or Throttling

An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. It allows attackers to cause a denial of service memory consumption via OpenGraph...

CVE-2019-20881: Improper Restriction of Excessive Authentication Attempts

An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA...

CVE-2019-20841: Cross-Site Request Forgery (CSRF)

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. CSRF can sometimes occur via a crafted web site for account takeover attacks...

CVE-2019-20878: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Changes, within the application, to e-mail addresses are mishandled...

PT-2020-8420

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: An issue was discovered in Mattermost Server when local storage for files is used, allowing a System Admin to achieve...

CVE-2016-11065: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance...