PT-2020-10832

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.10.0 Mattermost Server versions prior to 5.9.1 Mattermost Server versions prior to 5.8.2 Mattermost Server versions prior to 4.10.9 Description A non-member could change the "Update/Patch Channel" endpoint...

CVE-2019-20869: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Update/Patch Channel endpoint for a private channel...

CVE-2019-20867: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post...

PT-2020-10809

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.18.0 Description The issue is related to weak permissions for server-local file storage. Recommendations For versions prior to 5.18.0, update to version 5.18.0 or later to resolve the issue...

CVE-2019-20846: Improper Preservation of Permissions

An issue was discovered in Mattermost Server before 5.18.0. It has weak permissions for server-local file storage...

CVE-2019-20871: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic backtracking...

PT-2020-10828

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.12.0 Mattermost Server version 5.11.1 Mattermost Server version 5.10.2 Mattermost Server version 5.9.2 Mattermost Server version 4.10.10 Description An issue was discovered that allows CSRF on the login...

PT-2020-8901

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.1 Description An issue in Mattermost Server allows attackers to cause a denial of service via the invite people slash command. Recommendations For versions prior to 5.1, update to version 5.1 or later to...

PT-2020-10853

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.7 Mattermost Server version 5.6.3 and earlier Mattermost Server version 5.5.2 and earlier Mattermost Server version 4.10.5 and earlier Description The issue concerns the mishandling of permissions for...

Server side request forgery (ssrf)

A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified Mattermost server and room and send a message...

Mattermost Server Detection (HTTP)

HTTP based detection of Mattermost Server. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.108464...