Mattermost Security Vulnerabilities
An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service (memory consumption) via an outgoing webhook or a slash command...
7.5CVSS
7.5AI Score
0.001EPSS
3.7CVSS
4.3AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4. It allows remote attackers to cause a denial of service (memory consumption) via crafted image...
6.5CVSS
6.3AI Score
0.002EPSS
An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events were accidentally sent during certain user-management operations, violating user...
2.7CVSS
4.1AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny...
6.1CVSS
5.9AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication...
7.5CVSS
7.6AI Score
0.002EPSS
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary...
4.9CVSS
5.1AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary...
4.9CVSS
5.1AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the...
9.8CVSS
9.4AI Score
0.003EPSS
An issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use the invite_people slash command to invite a non-permitted...
4.3CVSS
4.6AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash...
7.5CVSS
7.3AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. An e-mail invite accidentally included the team invite_id, which leads to unintended excessive invitation...
4.3CVSS
4.6AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 4.10.1, 4.9.4, and 4.8.2. It allows attackers to cause a denial of service (application hang) via a malformed link in a...
5.3CVSS
5.2AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that...
4.3CVSS
4.5AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control (for direct-message channel creation) via the Message slash...
4.3CVSS
4.7AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for setting a channel header) via the Channel header slash command...
5.3CVSS
5.3AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations...
4.3CVSS
4.6AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field...
7.5CVSS
7.3AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic...
7.5CVSS
7.5AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local...
5.5CVSS
5.4AI Score
0.0004EPSS
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during a role...
7.5CVSS
7.2AI Score
0.002EPSS
An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for obtaining IP address information was...
5.3CVSS
5.2AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows...
8.8CVSS
8.6AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file...
4.3CVSS
4.6AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user...
6.5CVSS
6.2AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted...
5.3CVSS
5.2AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly...
7.5CVSS
7.5AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Update/Patch Channel endpoint for a private...
5.3CVSS
5.2AI Score
0.001EPSS
An issue was discovered in Mattermost Packages before 5.16.3. A Droplet could allow Internet access to a service that has a remote code execution...
9.8CVSS
9.5AI Score
0.009EPSS
An issue was discovered in Mattermost Server before 5.17.0. It allows remote attackers to cause a denial of service (client-side application crash) via a LaTeX...
7.5CVSS
7.3AI Score
0.002EPSS
An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib...
9.8CVSS
9.6AI Score
0.002EPSS
An issue was discovered in Mattermost Server before 5.16.0. It allows attackers to cause a denial of service (markdown renderer hang) via many backtick...
7.5CVSS
7.3AI Score
0.001EPSS
An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted...
8.8CVSS
8.8AI Score
0.003EPSS
An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to overwrite arbitrary files on a...
9.1CVSS
9AI Score
0.001EPSS
An issue was discovered in Mattermost Mobile Apps before 1.26.0. Local logging is not blocked for sensitive information (e.g., server addresses or message...
7.5CVSS
7.4AI Score
0.002EPSS
An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service (CPU consumption) via crafted characters in a SQL LIKE clause to an APIv4...
7.5CVSS
7.5AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information (local files) during legacy attachment...
7.5CVSS
7.2AI Score
0.002EPSS
An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted...
7.5CVSS
7.5AI Score
0.002EPSS
An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash...
7.5CVSS
7.4AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly...
7.5CVSS
7.5AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service (application hang) via a crafted SVG...
5.5CVSS
5.4AI Score
0.001EPSS
An issue was discovered in Mattermost Plugins before 5.13.0. The GitHub plugin allows an attacker to attach his Mattermost account to a different person's GitHub...
7.5CVSS
7.5AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka...
6.5CVSS
6.4AI Score
0.001EPSS
An issue was discovered in Mattermost Mobile Apps before 1.30.0. Authorization tokens can sometimes be disclosed to third-party servers, aka...
7.5CVSS
7.4AI Score
0.002EPSS
An issue was discovered in Mattermost Server before 5.21.0. mmctl allows directory traversal via HTTP, aka...
5.3CVSS
5.3AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not appropriately restricted, which allows attackers to cause a denial of service, aka...
7.5CVSS
7.3AI Score
0.001EPSS
An issue was discovered in Mattermost Desktop App before 4.4.0. Attackers can open web pages in the desktop application because server redirection is mishandled, aka...
6.1CVSS
6.2AI Score
0.001EPSS
An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during access-control decisions for web APIs, aka...
7.3CVSS
7.2AI Score
0.001EPSS
An issue was discovered in Mattermost Server before 5.19.0. Attackers can discover private channels via the "get channel by name" API, aka...
7.5CVSS
7.5AI Score
0.002EPSS
An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka...
7.5CVSS
7.4AI Score
0.001EPSS