mattermost vulnerabilities (Bitnami)
104 vulnerabilities.
mattermostBitnamiTodo plugin gets crashed and disabled by member4.3 MediummattermostBitnamiInaccessible Post Information Leak via Run Timeline IDOR6.5 MediummattermostBitnamiIDOR when updating the tasks of a private playbook run4.3 MediummattermostBitnamiPlaybook Plugin Crash via Run Checklist4.3 MediummattermostBitnamiPublic endpoint /metrics of Calls plugin reveals channel IDs5.3 MediummattermostBitnamiClient side path traversal due to lack of route parameters validation7.1 HighmattermostBitnamiDenial of Service via multiple identical User IDs in /api/v4/users/ids4.3 MediummattermostBitnamiFile Information Leak via IDOR in file_id in Draft Posts4.3 MediummattermostBitnamiDenial of Service via Opengraph Data Cache4.3 MediummattermostBitnamiParameter tampering in the registration resulting in blocked accounts to be created4.3 MediummattermostBitnamiServer crash via a specially crafted markdown input4.3 MediummattermostBitnamiDenial of Service via specially crafted gif image4.3 MediummattermostBitnamiGuest accounts invited and added to channels by Welcomebot plugin3.5 LowmattermostBitnamiLack of previous password reset tokens on new token creation4.8 MediummattermostBitnamiDeleted attachments in Boards remain accessible3.1 LowmattermostBitnamiInconsistent state in UI after boards permission change by system admin2.7 LowmattermostBitnamiDisabling publicly-shared boards does not disable existing publicly available board links4.2 MediummattermostBitnamichannel DoS by sharing a boards link4.3 MediummattermostBitnamiMember can create team with team override scheme3.1 LowmattermostBitnamiLack of channel membership check when linking a board to a channel4.3 MediummattermostBitnamiWebSockets accept connections from HTTPS origin6.2 MediummattermostBitnamiLimited blind SSRF to localhost/intranet in interactive dialog implementation3.5 LowmattermostBitnamiPrivilege escalation to system admin via personal access tokens4.7 MediummattermostBitnamiArchiving a team broadcasts unsanitized data over WebSockets3.1 LowmattermostBitnamiUser password logged in audit logs7.2 HighmattermostBitnamiInformation disclosure in linked message previews6.5 MediummattermostBitnamiStored XSS via SVG attachment on Boards7.3 HighmattermostBitnamiUnsanitized events sent over Websocket to regular users in a High Availability environment4.3 MediummattermostBitnamiUnauthorized email invite to a private channel4.2 MediummattermostBitnamiReflected XSS in OAuth flow completion endpoints3.5 LowmattermostBitnamiDisclosure of team owner email address when when accessing the teams API2.7 LowmattermostBitnamiDisclosure of team owner email address when regenerating Invite ID2.7 LowmattermostBitnamiServer-side Denial of Service while processing a specifically crafted GIF file3.1 LowmattermostBitnamiServer-side Denial of Service while processing a specifically crafted JPEG file3.1 LowmattermostBitnamiTeam members could access sensitive information of other users via an API call6.5 MediummattermostBitnamiIncorrect defaults can cause attackers to bypass rate limitations5.6 MediummattermostBitnamiA crafted SVG attachment can crash a Mattermost server4.3 MediummattermostBitnamiAuthorized users are allowed to install old plugin versions from the Marketplace4.7 MediummattermostBitnamiInvitation Email is resent as a Reminder after invalidating pending email invites3.7 LowmattermostBitnamiRestricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents4.3 MediummattermostBitnamiOOM DoS in Mattermost image proxy4.3 MediummattermostBitnamiStack overflow in document extractor in Mattermost4.3 MediummattermostBitnamiStack overflow in SAML login in Mattermost5.3 MediummattermostBitnamiMattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which...3.5 LowmattermostBitnamiMattermost 6.0 and earlier fails to sufficiently validate the email address during registration,...3.7 LowmattermostBitnamiAn issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8....6.5 MediummattermostBitnamiAn issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and...7.5 HighmattermostBitnamiAn issue was discovered in Mattermost Server before 5.19.0. Attackers can discover private...7.5 HighmattermostBitnamiMattermost Server Sensitive Data Exposure5.3 MediummattermostBitnamiAn issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not...7.5 High- Show moreLoading…