PT-2020-10836

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.9.0 Mattermost Server versions prior to 5.8.1 Mattermost Server versions prior to 5.7.3 Mattermost Server versions prior to 4.10.8 Description An issue in Mattermost Server allows attackers to obtain...

CVE-2017-18878: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session...

CVE-2019-20862: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands...

PT-2020-10842

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.8.0 Mattermost Server versions prior to 5.7.2 Mattermost Server versions prior to 5.6.5 Mattermost Server versions prior to 4.10.7 Description An issue was discovered where changes to e-mail addresses do n...

PT-2020-10852

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.7 Mattermost Server version 5.6.3 and earlier Mattermost Server version 5.5.2 and earlier Mattermost Server version 4.10.5 and earlier Description An issue in Mattermost Server allows attackers to cause a...

CVE-2018-21252: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers could use multiple e-mail addresses to bypass a domain-based policy for signups...

CVE-2019-20885: Missing Authorization

An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file...

PT-2020-8000

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.1.0 Description: The issue allows for XSS attacks due to the absence of noreferrer and noopener protection mechanisms. Recommendations: For versions prior to 3.1.0, update to version 3.1.0 or later to...

PT-2020-8896

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.1 Mattermost Server version 5.0.2 and earlier Mattermost Server version 4.10.2 and earlier Description An issue was discovered in Mattermost Server. An attacker could use the invite people slash command to...

CVE-2017-18919: Improper Authentication

An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation...

PT-2020-8907

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 4.7.0 Mattermost Server version 4.6.2 Mattermost Server version 4.5.2 Description An issue was discovered where the expiration date of a SAML response was not enforced. Recommendations For versions prior to...

PT-2020-10845

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.8.0 Description The issue concerns the mishandling of brute-force attacks against Multi-Factor Authentication MFA in the affected software. Recommendations For versions prior to 5.8.0, update to version...

PT-2020-10825

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.13.0 Description An issue was discovered that allows non-members to fetch a team's slash commands. Recommendations For versions prior to 5.13.0, update to version 5.13.0 or later to resolve the issue...

PT-2020-8894

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.2 Mattermost Server version 5.1.1 and earlier Description An issue allows authorization to be bypassed if the channel name in the parameters and the body are not the same. Recommendations For Mattermost...

PT-2020-8906

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 4.7.0 Mattermost Server version 4.6.2 and earlier Mattermost Server version 4.5.2 and earlier Description An issue allows an attacker to authenticate to a different user's account via a crafted SAML response...

CVE-2017-18881: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a gotolocation response to a slash command...

PT-2020-8003

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.0.0 Description: An issue was discovered where a password-reset link could be reused. Recommendations: For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue...

PT-2020-10822

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.15.0 Description An issue allows login access control to be bypassed via crafted input. Recommendations For versions prior to 5.15.0, update to version 5.15.0 or later to resolve the issue...

PT-2020-8445

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.2.0 Mattermost Server version 4.1.1 Mattermost Server version 4.0.5 Description: The issue concerns the mishandling of IP-based rate limiting, which could potentially lead to exploitation. Recommendations...

PT-2020-8430

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: An issue was discovered in Mattermost Server that allows attackers to gain privileges by using a registered OAuth applicati...