Mattermost Server Security Vulnerabilities and Issues — Mattermost Server CVE List

Lucene search

MattermostMattermost Server

13 matches found

CVE•added 2023/12/06 9:15 a.m.•143 views

CVE-2023-6458

Mattermost webapp fails to validate route parameters in//channels/ allowing an attacker to perform a client-side path traversal.

9.8CVSS8AI score0.00397EPSS

CVE•added 2025/06/20 11:15 a.m.•57 views

CVE-2025-4981

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x

9.9CVSS9.7AI score0.00264EPSS

CVE•added 2020/06/19 7:15 p.m.•51 views

CVE-2017-18885

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf.

9.8CVSS9.5AI score0.00408EPSS

CVE•added 2020/06/19 7:15 p.m.•38 views

CVE-2017-18883

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.

9.1CVSS9.2AI score0.00313EPSS

CVE•added 2020/06/19 8:15 p.m.•35 views

CVE-2016-11074

An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.

9.8CVSS9.3AI score0.00408EPSS

CVE•added 2020/06/19 8:15 p.m.•33 views

CVE-2017-18908

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address.

9.8CVSS9.3AI score0.00408EPSS

CVE•added 2020/06/19 7:15 p.m.•30 views

CVE-2017-18888

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows SQL injection during the fetching of multiple posts.

9.8CVSS9.8AI score0.00415EPSS

CVE•added 2020/06/19 8:15 p.m.•29 views

CVE-2017-18915

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.

9.8CVSS9.5AI score0.00408EPSS

CVE•added 2020/06/19 7:15 p.m.•28 views

CVE-2017-18900

An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report.

9.8CVSS9.4AI score0.00647EPSS

CVE•added 2020/06/19 7:15 p.m.•26 views

CVE-2017-18911

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server.

9.1CVSS9.1AI score0.00136EPSS

CVE•added 2020/06/19 7:15 p.m.•26 views

CVE-2017-18912

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. It allows an attacker to specify a full pathname of a log file.

9.8CVSS9.2AI score0.00733EPSS

CVE•added 2020/06/19 5:15 p.m.•26 views

CVE-2018-21251

An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body.

9.8CVSS9.4AI score0.00408EPSS

CVE•added 2020/06/19 8:15 p.m.•25 views

CVE-2017-18920

An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy.

9.8CVSS9.4AI score0.00504EPSS