CVE-2020-14451

CVE-2020-14451 describes a flaw in Mattermost Mobile Apps (iOS) prior to version 1.29.0 where Single Sign-On cookies and Local Storage were not cleared on logout, potentially allowing access to residual authentication state after sign-out. The issue is due to the app not clearing SSO cookies/loca...

CVE-2020-14451

An issue was discovered in Mattermost Mobile Apps before 1.29.0. The iOS app allowed Single Sign-On cookies and Local Storage to remain after a logout, aka MMSA-2020-0013...

CVE-2020-14450

Mattermost Server prior to version 5.22.0 is affected by a client-side denial of service via the markdown renderer (CVE-2020-14450, aka MMSA-2020-0017). The issue is triggered during markdown rendering and impacts availability from a client perspective. The Red Hat, OSV, and other feeds confirm t...

CVE-2020-14450

An issue was discovered in Mattermost Server before 5.22.0. The markdown renderer allows attackers to cause a denial of service client-side, aka MMSA-2020-0017...

CVE-2020-14449

Technical details are not publicly provided in the supplied documents. The materials mention Mattermost Mobile Apps before 1.30.0 and token disclosure to third-party servers, but no concrete guidance on affected components, exploit methods, or fixes is included. Monitor updates.

CVE-2020-14449

An issue was discovered in Mattermost Mobile Apps before 1.30.0. Authorization tokens can sometimes be disclosed to third-party servers, aka MMSA-2020-0018...

CVE-2020-14448

An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0020...

CVE-2020-14448

Mattermost Server before 5.23.0 has a vulnerability in automatic direct message (DM) replies that can be exploited to cause a denial of service via an infinite loop (CVE-2020-14448). Affected component: image-free DM reply handling in Mattermost Server. Underlying cause: the issue arises from how...

CVE-2020-14447

An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0021...

CVE-2020-14447

Mattermost Server prior to version 5.23.0 is affected by CVE-2020-14447. The issue allows attackers to trigger a denial of service (infinite loop) by sending large webhook requests. The vulnerability is associated with large webhook payload handling and is documented across multiple sources (NVD ...

PT-2020-8454

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.0.0 Mattermost Server version 3.10.2 Mattermost Server version 3.9.2 Description: An issue was discovered where a password-reset request could be sent to an attacker-provided e-mail address...

PT-2020-14018 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.19.0 Description: An issue allows attackers to discover private channels via the "get channel by name" API endpoint. Recommendations: For versions prior to 5.19.0, update to version 5.19.0 or later to...

PT-2020-7995

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.2.0 Description: An issue was discovered in the Mattermost Server where the initial load API endpoint disclosed unnecessary personal information. Recommendations: For versions prior to 3.2.0, update to...

PT-2020-8442

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.2.0 Mattermost Server version 4.1.1 Mattermost Server version 4.0.5 Description: The issue allows attackers to add DEBUG lines to the logs via a REST API version 3 logging endpoint. Recommendations: For...

PT-2020-8438

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.2.0 Mattermost Server version 4.1.1 Mattermost Server version 4.0.5 Description: An issue was discovered in Mattermost Server where e-mail templates can have a field in which HTML content is not...

PT-2020-8458

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7 Description: An issue was discovered that allows an attacker to specify a full pathname of a log file...

PT-2020-14007 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.23.0 Description: An issue allows attackers to cause a denial of service infinite loop by sending large webhook requests. Recommendations: For versions prior to 5.23.0, update to version 5.23.0 or later t...

PT-2020-14012 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.21.0 Description: An issue was discovered that allows directory traversal via HTTP. This issue affects Mattermost Server and is related to the mmctl component. Recommendations: For versions prior to 5.21....

PT-2020-8452

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.0.0 Mattermost Server version 3.10.2 Mattermost Server version 3.9.2 Description: An issue was discovered when Single Sign-On OAuth2 is used, allowing an attacker to claim somebody else's account...

PT-2020-14013 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.21.0 Description: An issue was discovered that allows attackers to cause a denial of service due to socket read operations not being appropriately restricted. Recommendations: For versions prior to 5.21.0...