CVE-2023-2514

Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization...

Design/Logic Flaw

Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization...

CVE-2023-2514 DB username/password revealed in application logs

Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization...

CVE-2023-2514 DB username/password revealed in application logs

Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization...

PT-2023-19934 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server affected versions not specified Description: The issue concerns the Mattermost Server, where it fails to properly redact the database username and password before logging this information during server initialization...

Mattermost 日志信息泄露漏洞

Mattermost is an open source collaboration platform from US-based Mattermost. A log information disclosure vulnerability exists in Mattermost Sever, which stems from the inability to edit database usernames and passwords before issuing application logs during server initialization...

Mattermost Server < 7.1.6 / 7.2.x < 7.7.2 XSS (MMSA-2023-00139)

The version of Mattermost Server running on the remote host is prior to 7.1.6 or 7.2.x prior to 7.7.2. It is, therefore , affected by a cross-site scripting XSS vulnerability. An authenticated, remote attacker can upload a malicious SVG image file as an attachment to a card and share it using a...

Mattermost Server < 7.1.6 / 7.2.x < 7.7.2 / 7.8.x < 7.8.1 Information Disclosure (MMSA-2023-00141)

The version of Mattermost Server running on the remote host is prior to 7.1.6, 7.2.x prior to 7.7.2 or 7.8.x prior to 7.8.1. It is, therefore, affected by an information disclosure vulnerability. An unauthenticated, remote attacker can request a preview of an existing message when creating a new...

Information Disclosure

github.com/mattermost/mattermost-server is vulnerable to Information Disclosure. The vulnerability exists because the library fails to sanitize the related WebSocket event sent to currently connected clients, which allows an attacker to see the name, display name, description, and other data when...

Cross-Site Scripting (XSS)

github.com/mattermost/mattermost-server is vulnerable to Cross-Site Scripting XSS attacks. An attacker is able to send AJAX requests on behalf of the victim through OAuth flow completion endpoints via sharing a crafted link with a malicious state parameter...

Mattermost Server < 7.1.4 / 7.2.x < 7.2.1 / 7.3.x < 7.3.1 DoS (MMSA-2022-00120)

The version of Mattermost Server running on the remote host is prior to 7.1.4, 7.2.x prior to 7.2.1, or 7.3.x prior to 7.3.1. It is, therefore, affected by a denial of service DoS vulnerability. An authenticated, remote attacker can crash the server via multiple large out-of-office or autorespond...

Mattermost Server < 7.4.0 DoS (MMSA-2022-00124)

The version of Mattermost Server running on the remote host is prior to 7.4.0. It is, therefore, affected by a denial of service DoS vulnerability. An authenticated, remote attacker can crash the server via multiple requests to one of the API endpoints which could fetch a large amount of data. No...

Denial Of Service (DOS)

github.com/mattermost/mattermost-server is vulnerable to Denial Of Service DOS. The vulnerability exists in userstore.go because it will send multiple requests to one of the api endpoints which could fetch a large amount of data by an authenticated user to crash the server...

Vulnerabilities fixed in Mattermost Server

Two vulnerabilities have been fixed in Mattermost Server. The vulnerabilities allow an authenticated remote malicious person able to perform a denial-of-service attack by crashing the server crashing the server. To do this, the malicious party must send multiple prepared requests to the server...

CVE-2022-4045 Authenticated user could send multiple requests containing a parameter which could fetch a large amount of data and can crash a Mattermost server

A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which could fetch a large amount of data...

CVE-2022-4044 Authenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost server

A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages...

Mattermost Server 7.1.0 DoS (MMSA-2022-00115)

The version of Mattermost Server running on the remote host is 7.1.0. It is, therefore, affected by a denial of service DoS vulnerability. An authenticated, remote attacker can upload a specially crafted GIF file when creating a post which causes resource exhaustion on the host. Note that Nessus...

Mattermost Server Detection

Binary data mattermostserverdetect.nbin...

Denial Of Service (DoS)

github.com/mattermost/mattermost-server is vulnerable to denial of service. The vulnerability exists in multiple functions in gif.go due to resource exhaustion in gif file which allows an attacker to cause an application crash via a malicious input...

CVE-2022-1982 A crafted SVG attachment can crash a Mattermost server

Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on a post...