github.com/mattermost/mattermost-server/v5 vulnerabilities (Go)
199 vulnerabilities.
github.com/mattermost/mattermost-server/v5GoInformation disclosure via channel mentions in posts4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoUser profile update exposes password hash and MFA secrets5.7 Mediumgithub.com/mattermost/mattermost-server/v5GoAuthentication bypass via userID login when email and username login are disabled5.4 Mediumgithub.com/mattermost/mattermost-server/v5GoMattermost Jira plugin crafted action leaks Jira issue details4.1 Mediumgithub.com/mattermost/mattermost-server/v5GoUnauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoMattermost Jira plugin user spoofing enables Jira request forgery.7.2 Highgithub.com/mattermost/mattermost-server/v5GoLack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation3.7 Lowgithub.com/mattermost/mattermost-server/v5GoOpen redirect in error page when link opened in new tab3.1 Lowgithub.com/mattermost/mattermost-server/v5GoMattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking3.0 Lowgithub.com/mattermost/mattermost-server/v5GoUnauthorized access and subscription vulnerability in Boards3.1 Lowgithub.com/mattermost/mattermost-server/v5GoInsecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoAccount Takeover via Code Exchange Endpoint9.9 Criticalgithub.com/mattermost/mattermost-server/v5GoInformation Disclosure in Common Teams API4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoAccount takeover on OAuth/OpenID-enabled servers9.9 Criticalgithub.com/mattermost/mattermost-server/v5GoChannel member objects leak read status3.0 Lowgithub.com/mattermost/mattermost-server/v5GoPassword hash and MFA secret returned in user email verification endpoint4.9 Mediumgithub.com/mattermost/mattermost-server/v5GoMS Teams plugin OAuth allows editing arbitrary posts5.4 Mediumgithub.com/mattermost/mattermost-server/v5GoLack of MFA enforcement in WebSocket connections6.5 Mediumgithub.com/mattermost/mattermost-server/v5GoUnauthorized access to archived channel content via threads interface3.1 Lowgithub.com/mattermost/mattermost-server/v5GoGuest user can discover archived public channels4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoCross-team channel membership access3.1 Lowgithub.com/mattermost/mattermost-server/v5GoArbitrary Mattermost Team can be joined by manipulating the OAuth state8.1 Highgithub.com/mattermost/mattermost-server/v5GoSlack import bypasses email verification for team access controls5.4 Mediumgithub.com/mattermost/mattermost-server/v5GoGuest user can add unauthorized team users to private channels3.1 Lowgithub.com/mattermost/mattermost-server/v5GoArbitrary Mattermost Team can be joined by manipulating the SAML RelayState8.1 Highgithub.com/mattermost/mattermost-server/v5GoInsecure string comparison enables timing attacks3.1 Lowgithub.com/mattermost/mattermost-server/v5GoIDOR in board file download allows any user to download any file by UUID3.1 Lowgithub.com/mattermost/mattermost-server/v5GoAdmin RCE via prepackaged plugins by way of misconfigured imports directory8.0 Highgithub.com/mattermost/mattermost-server/v5GoOne-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter7.6 Highgithub.com/mattermost/mattermost-server/v5GoOpen redirect in OAuth login3.1 Lowgithub.com/mattermost/mattermost-server/v5GoWeak cache keys lead to post IDOR and link preview poisoning4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoMattermost Server exposes sensitive user credentials during shared channel membership synchronization6.5 Mediumgithub.com/mattermost/mattermost-server/v5GoNil pointer dereference in bulk import crashes server4.9 Mediumgithub.com/mattermost/mattermost-server/v5GoPath traversal in image upload with preview overwrite4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoTeam invite ID leaked to team admin with no member invite privileges4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoMattermost Shared Channel Upload Type Validation Bypass6.8 Mediumgithub.com/mattermost/mattermost-server/v5GoPath Traversal in Template Upload Allows Uploading Files Outside Target Directory6.8 Mediumgithub.com/mattermost/mattermost-server/v5GoChannel and Team Membership APIs inadvertently allow loss of Member privileges.3.8 Lowgithub.com/mattermost/mattermost-server/v5GoAI plugin APIs can be triggered using post actions3.5 Lowgithub.com/mattermost/mattermost-server/v5GoThread summarization allows persistent access to channel3.5 Lowgithub.com/mattermost/mattermost-server/v5GoImport Path Traversal Enables Unauthorized Unsigned Plugin Installation6.8 Mediumgithub.com/mattermost/mattermost-server/v5GoInvite token is used as part of the secure communication2.2 Lowgithub.com/mattermost/mattermost-server/v5GoArbitrary file read by system admin via path traversal6.8 Mediumgithub.com/mattermost/mattermost-server/v5GoIDOR in CreatePost API allows for timeboxed message disclosure6.5 Mediumgithub.com/mattermost/mattermost-server/v5GoMattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoMattermost Playbooks allows privilege escalation through improper access control in playbook run participant management5.4 Mediumgithub.com/mattermost/mattermost-server/v5GoUnauthorized Guest user access to Playbook4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoUnauthorized channel member management through playbook runs4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoPath Traversal Leading to RCE by Any Authenticated Mattermost User9.9 Criticalgithub.com/mattermost/mattermost-server/v5GoMattermost Guest User Information Disclosure Vulnerability3.1 Low- Show moreLoading…