PT-2020-8456

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7 Description: An issue was discovered where e-mail notifications can have spoofed links. Recommendations: For version...

CVE-2019-20885: Missing Authorization

An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file...

CVE-2016-11071: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place...

PT-2020-8000

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.1.0 Description: The issue allows for XSS attacks due to the absence of noreferrer and noopener protection mechanisms. Recommendations: For versions prior to 3.1.0, update to version 3.1.0 or later to...

PT-2020-8896

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.1 Mattermost Server version 5.0.2 and earlier Mattermost Server version 4.10.2 and earlier Description An issue was discovered in Mattermost Server. An attacker could use the invite people slash command to...

CVE-2017-18919: Improper Authentication

An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation...

PT-2020-10826

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.13.0 Description An issue was discovered where incoming webhook creation is not properly restricted. Recommendations For versions prior to 5.13.0, update to version 5.13.0 or later to resolve the issue...

PT-2020-8907

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 4.7.0 Mattermost Server version 4.6.2 Mattermost Server version 4.5.2 Description An issue was discovered where the expiration date of a SAML response was not enforced. Recommendations For versions prior to...

PT-2020-10845

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.8.0 Description The issue concerns the mishandling of brute-force attacks against Multi-Factor Authentication MFA in the affected software. Recommendations For versions prior to 5.8.0, update to version...

PT-2020-10825

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.13.0 Description An issue was discovered that allows non-members to fetch a team's slash commands. Recommendations For versions prior to 5.13.0, update to version 5.13.0 or later to resolve the issue...

PT-2020-8894

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.2 Mattermost Server version 5.1.1 and earlier Description An issue allows authorization to be bypassed if the channel name in the parameters and the body are not the same. Recommendations For Mattermost...

PT-2020-10847

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.8.0 Description An issue was discovered in Mattermost Server when Town Square is set to Read-Only, allowing users to pin or unpin a post. Recommendations For versions prior to 5.8.0, update to version 5.8....

PT-2020-8906

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 4.7.0 Mattermost Server version 4.6.2 and earlier Mattermost Server version 4.5.2 and earlier Description An issue allows an attacker to authenticate to a different user's account via a crafted SAML response...

PT-2020-10804

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.18.0 Mattermost Server version 5.17.2 Mattermost Server version 5.16.4 Mattermost Server version 5.15.4 Mattermost Server version 5.9.7 Description An issue in Mattermost Server allows CSRF to sometimes...

CVE-2017-18881: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a gotolocation response to a slash command...

PT-2020-7999

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.1.0 Description: The issue allows for cross-site scripting XSS attacks via theme color-code values. This means an attacker could potentially inject malicious code into a website, exploiting the...

PT-2020-8003

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.0.0 Description: An issue was discovered where a password-reset link could be reused. Recommendations: For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue...

PT-2020-14012 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.21.0 Description: An issue was discovered that allows directory traversal via HTTP. This issue affects Mattermost Server and is related to the mmctl component. Recommendations: For versions prior to 5.21....

PT-2020-10822

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.15.0 Description An issue allows login access control to be bypassed via crafted input. Recommendations For versions prior to 5.15.0, update to version 5.15.0 or later to resolve the issue...

CVE-2017-18886: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands...