GO-2024-3334 Mattermost Server Resource Exhaustion in github.com/mattermost/mattermost-server

Mattermost Server Resource Exhaustion in github.com/mattermost/mattermost-server...

Mattermost Server 9.5.x < 9.5.12, 9.11.x < 9.11.4, 10.0.x < 10.0.2, 10.1.x < 10.1.2, 10.2.0 (MMSA-2024-00386)

The version of Mattermost Server installed on the remote host is prior to 9.5.12, 9.11.4, 10.0.2, 10.1.2 or 10.2.0. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00386 advisory. - Mattermost versions 10.0.x = 10.0.1, 10.1.x = 10.1.1, 9.11.x = 9.11.3, 9.5.x = 9.5.11...

BIT-MATTERMOST-2024-21848

Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in the call even if they are removed from the channel...

BIT-MATTERMOST-2024-28053

Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server...

BIT-MATTERMOST-2024-29221

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the /api/v4/users/me/teams endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users,...

Mattermost Server 9.5.x < 9.5.10, 9.10.x < 9.10.3, 9.11.x < 9.11.2, 10.0.x < 10.0.1, 10.1.0 (MMSA-2024-00381)

The version of Mattermost Server installed on the remote host is prior to 9.5.10, 9.10.3, 9.11.2, 10.0.1 or 10.1.0. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00381 advisory. - Mattermost versions 9.10.x = 9.10.2, 9.11.x = 9.11.1, 9.5.x = 9.5.9 and 10.0.x = 10.0....

Information Disclosure

github.com/mattermost/mattermost-server is vulnerable to Information Disclosure. The vulnerability is due to improper querying of Elasticsearch, which allows attackers to obtain the names of private channels they are not members of when Elasticsearch v8 is enabled...

MFA Code Replay Attacks

github.com/mattermost/mattermost-server is vulnerable to MFA code replay attacks. The vulnerability is due to insufficient validation of MFA codes, which allows attackers to reuse the same codes within approximately 30 seconds...

GO-2024-3235 Mattermost server allows authenticated user to delete arbitrary post in github.com/mattermost/mattermost-server

Mattermost server allows authenticated user to delete arbitrary post in github.com/mattermost/mattermost-server...

GO-2024-3232 Mattermost Server allows user to get private channel names in github.com/mattermost/mattermost-server

Mattermost Server allows user to get private channel names in github.com/mattermost/mattermost-server...

Denial Of Service (DoS)

github.com/mattermost/mattermost-server is vulnerable to Denial Of Service DoS. The vulnerability is due to improper memory management in the image proxy component, which allows an attacker to allocate excessive memory for multiple copies of proxied images without adequately handling large file...

Mattermost Server 9.5.x < 9.5.9 / 9.9.x < 9.9.3 / 9.10.x < 9.10.2 (MMSA-2024-00362)

The version of Mattermost Server installed on the remote host is prior to 9.5.9, 9.9.3, or 9.10.2. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00362 advisory. - Mattermost versions 9.10.x = 9.10.1, 9.9.x = 9.9.2, 9.5.x = 9.5.8 fail to limit access to channels file...

Mattermost Server 9.5.x < 9.5.8 / 9.8.x < 9.8.3 / 9.9.x < 9.9.2 / 9.10.x < 9.10.1 (MMSA-2024-00365)

The version of Mattermost Server installed on the remote host is prior to 9.5.8, 9.8.3, 9.9.2, or 9.10.1. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00365 advisory. - Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2 fail to restric...

Mattermost Server 9.5.x < 9.5.8 / 9.8.x < 9.8.3 / 9.9.x < 9.9.2 / 9.10.x < 9.10.1 (MMSA-2024-00368)

The version of Mattermost Server installed on the remote host is prior to 9.5.8, 9.8.3, 9.9.2, or 9.10.1. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00368 advisory. - Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2 fail to sanitiz...

Mattermost Server 9.5.x < 9.5.9 / 9.11.x < 9.11.1 (MMSA-2024-00373)

The version of Mattermost Server installed on the remote host is prior to 9.5.9 or 9.11.1. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00373 advisory. - Mattermost versions 9.11.x = 9.11.0 and 9.5.x = 9.5.8 fail to validate that the message of the permalink post i...

Mattermost Server 9.5.x < 9.5.9 (MMSA-2024-00358)

The version of Mattermost Server installed on the remote host is prior to 9.5.9. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00358 advisory. - Mattermost versions 9.5.x = 9.5.8 fail to properly authorize access to archived channels when viewing archived channels i...

Mattermost Server 9.5.x < 9.5.8 / 9.8.x < 9.8.3 / 9.9.x < 9.9.2 / 9.10.x < 9.10.1 (MMSA-2024-00374)

The version of Mattermost Server installed on the remote host is prior to 9.5.8, 9.8.3, 9.9.2, or 9.10.1. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00374 advisory. - Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0 and 9.8.x = 9.8.2 fail to...

Mattermost Server 9.5.x < 9.5.8 / 9.10.x < 9.10.1 (MMSA-2024-00359)

The version of Mattermost Server installed on the remote host is prior to 9.5.8 or 9.10.1. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00359 advisory. - Mattermost versions 9.5.x = 9.5.7 and 9.10.x = 9.10.0 fail to time limit and size limit the CA path file in the...

Mattermost Server 9.5.x < 9.5.9 / 9.9.x < 9.9.2 / 9.10.x < 9.10.2 / 9.11.x < 9.11.1 (MMSA-2024-00351)

The version of Mattermost Server installed on the remote host is prior to 9.5.9, 9.9.2, 9.10.2, or 9.11.1. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00351 advisory. - Mattermost versions 9.11.x = 9.11.0, 9.10.x = 9.10.1, 9.9.x = 9.9.2 and 9.5.x = 9.5.8 fail to...

GO-2024-3093 Mattermost doesn't redact remote users' original email addresses in github.com/mattermost/mattermost-server

Mattermost doesn't redact remote users' original email addresses in github.com/mattermost/mattermost-server...