Mattermost 安全漏洞

Mattermost Server is the United States Mattermost company's set of open source messaging platform. Mattermost Server suffers from an Access Control Error vulnerability that can be exploited by an attacker to run a script in an existing channel in order to elevate to channel administrator...

Mattermost 安全漏洞

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security bypass vulnerability exists in Mattermost Server, which can be exploited by an attacker to bypass access restrictions and learn about the members of an AD/LDAP group linked to a team by...

Denial Of Service (DoS)

github.com/mattermost/mattermost-server is vulnerable to Denial Of Service. The vulnerability is due to a lack of session limit enforcement, enabling an authenticated attacker to crash the server by flooding the sessions table through repeated requests to the getSessions API...

Sensitive Information Disclosure

github.com/mattermost/mattermost-server is vulnerable to Sensitive Information Disclosure. The vulnerability is due to a failure to remove detailed error messages in API requests, even when developer mode is off, allowing attackers to obtain sensitive server information such as file paths...

Improper Access Control

Mattermost Server is vulnerable to Improper Access Control. The vulnerability is due to incomplete validation of role changes within team.go, allowing an attacker authenticated as a team admin to promote guests to team admins through crafted HTTP requests...

Improper Access Control

Mattermost Server is vulnerable to Improper Access Control. The vulnerability is due to improper validation when updating team member roles, allowing users with certain administrative privileges to demote other users to guest status through crafted HTTP requests...

Mattermost Server Uncontrolled Resource Consumption Vulnerability

Mattermost Server is the United States Mattermost company's set of open source messaging platform. Mattermost Server suffers from an uncontrolled resource consumption vulnerability that can be exploited by an attacker to cause a denial of service by sending a large request path...

Mattermost 安全漏洞

Mattermost Server is the United States Mattermost company's set of open source messaging platform. Mattermost Server suffers from an uncontrolled resource consumption vulnerability that can be exploited by an attacker to cause a denial of service by sending a large request path...

Mattermost Server < 8.1.11 / 9.x < 9.3.3 / 9.4.x < 9.4.4 / 9.5.x < 9.5.2 Multiple Vulnerabilities

The version of Mattermost Server installed on the remote host is prior to 8.1.11, 9.x prior to 9.3.3, 9.4.x prior to 9.4.4, or 9.5.x prior to 9.5.2. It is, therefore, affected by multiple vulnerabilities as referenced in the MMSA-2024-00306, MMSA-2023-00274, and MMSA-2024-00311 advisories: -...

Mattermost Server Denial of Service Vulnerability (CNVD-2024-22872)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A denial of service vulnerability exists in Mattermost Server that stems from an unrestricted number of user preferences, which can be exploited by an attacker to cause a denial of service...

Improper Access Control

Mattermost Server is vulnerable to Improper Access Control . The vulnerability is caused due to a lack of proper access control in the SanitizeTeam function within team.go. This allows an attacker to invite others to the team, bypassing intended access controls and permissions...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is due to a flaw that allows an attacker in a channel with an active call to remain in the call even after being removed from the channel...

Mattermost Server Improper Access Control

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the /api/v4/users/me/teams endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users,...

Mattermost Server doesn't limit the number of user preferences

Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service...

GHSA-MCW6-3256-64GG Mattermost Server doesn't limit the number of user preferences

Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service...

GHSA-W67V-PH4X-F48Q Mattermost Server Improper Access Control

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the /api/v4/users/me/teams endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users,...

CVE-2024-21848

Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in the call even if they are removed from the channel...

CVE-2024-29221

CVE-2024-29221 (Mattermost Server) describes improper access control in the /api/v4/users/me/teams endpoint, where a team admin could obtain the team invite ID and invite users despite lacking the Add Members permission. Affected versions include 8.1.x before 8.1.11, 9.x before 9.3.3/9.4.4/9.5.2....

CVE-2024-29221 Invite ID available to team admins even without the "Add Members" permission

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the /api/v4/users/me/teams endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users,...

CVE-2024-29221 Invite ID available to team admins even without the "Add Members" permission

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the /api/v4/users/me/teams endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users,...