github.com/mattermost/mattermost-server/v6 vulnerabilities (Go)
222 vulnerabilities.
github.com/mattermost/mattermost-server/v6GoInformation disclosure via channel mentions in posts4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoUser profile update exposes password hash and MFA secrets5.7 Mediumgithub.com/mattermost/mattermost-server/v6GoAuthentication bypass via userID login when email and username login are disabled5.4 Mediumgithub.com/mattermost/mattermost-server/v6GoMattermost Jira plugin crafted action leaks Jira issue details4.1 Mediumgithub.com/mattermost/mattermost-server/v6GoUnauthorized Read Access to Private Channel Posts via Mattermost Jira Plugin4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoMattermost Jira plugin user spoofing enables Jira request forgery.7.2 Highgithub.com/mattermost/mattermost-server/v6GoLack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation3.7 Lowgithub.com/mattermost/mattermost-server/v6GoOpen redirect in error page when link opened in new tab3.1 Lowgithub.com/mattermost/mattermost-server/v6GoMattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking3.0 Lowgithub.com/mattermost/mattermost-server/v6GoUnauthorized access and subscription vulnerability in Boards3.1 Lowgithub.com/mattermost/mattermost-server/v6GoInsecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoAccount Takeover via Code Exchange Endpoint9.9 Criticalgithub.com/mattermost/mattermost-server/v6GoInformation Disclosure in Common Teams API4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoAccount takeover on OAuth/OpenID-enabled servers9.9 Criticalgithub.com/mattermost/mattermost-server/v6GoChannel member objects leak read status3.0 Lowgithub.com/mattermost/mattermost-server/v6GoPassword hash and MFA secret returned in user email verification endpoint4.9 Mediumgithub.com/mattermost/mattermost-server/v6GoMS Teams plugin OAuth allows editing arbitrary posts5.4 Mediumgithub.com/mattermost/mattermost-server/v6GoLack of MFA enforcement in WebSocket connections6.5 Mediumgithub.com/mattermost/mattermost-server/v6GoUnauthorized access to archived channel content via threads interface3.1 Lowgithub.com/mattermost/mattermost-server/v6GoGuest user can discover archived public channels4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoCross-team channel membership access3.1 Lowgithub.com/mattermost/mattermost-server/v6GoArbitrary Mattermost Team can be joined by manipulating the OAuth state8.1 Highgithub.com/mattermost/mattermost-server/v6GoSlack import bypasses email verification for team access controls5.4 Mediumgithub.com/mattermost/mattermost-server/v6GoGuest user can add unauthorized team users to private channels3.1 Lowgithub.com/mattermost/mattermost-server/v6GoArbitrary Mattermost Team can be joined by manipulating the SAML RelayState8.1 Highgithub.com/mattermost/mattermost-server/v6GoInsecure string comparison enables timing attacks3.1 Lowgithub.com/mattermost/mattermost-server/v6GoIDOR in board file download allows any user to download any file by UUID3.1 Lowgithub.com/mattermost/mattermost-server/v6GoAdmin RCE via prepackaged plugins by way of misconfigured imports directory8.0 Highgithub.com/mattermost/mattermost-server/v6GoOne-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter7.6 Highgithub.com/mattermost/mattermost-server/v6GoOpen redirect in OAuth login3.1 Lowgithub.com/mattermost/mattermost-server/v6GoWeak cache keys lead to post IDOR and link preview poisoning4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoMattermost Server exposes sensitive user credentials during shared channel membership synchronization6.5 Mediumgithub.com/mattermost/mattermost-server/v6GoNil pointer dereference in bulk import crashes server4.9 Mediumgithub.com/mattermost/mattermost-server/v6GoPath traversal in image upload with preview overwrite4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoTeam invite ID leaked to team admin with no member invite privileges4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoMattermost Shared Channel Upload Type Validation Bypass6.8 Mediumgithub.com/mattermost/mattermost-server/v6GoPath Traversal in Template Upload Allows Uploading Files Outside Target Directory6.8 Mediumgithub.com/mattermost/mattermost-server/v6GoChannel and Team Membership APIs inadvertently allow loss of Member privileges.3.8 Lowgithub.com/mattermost/mattermost-server/v6GoAI plugin APIs can be triggered using post actions3.5 Lowgithub.com/mattermost/mattermost-server/v6GoThread summarization allows persistent access to channel3.5 Lowgithub.com/mattermost/mattermost-server/v6GoImport Path Traversal Enables Unauthorized Unsigned Plugin Installation6.8 Mediumgithub.com/mattermost/mattermost-server/v6GoInvite token is used as part of the secure communication2.2 Lowgithub.com/mattermost/mattermost-server/v6GoArbitrary file read by system admin via path traversal6.8 Mediumgithub.com/mattermost/mattermost-server/v6GoIDOR in CreatePost API allows for timeboxed message disclosure6.5 Mediumgithub.com/mattermost/mattermost-server/v6GoMattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoMattermost Playbooks allows privilege escalation through improper access control in playbook run participant management5.4 Mediumgithub.com/mattermost/mattermost-server/v6GoUnauthorized Guest user access to Playbook4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoUnauthorized channel member management through playbook runs4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoPath Traversal Leading to RCE by Any Authenticated Mattermost User9.9 Criticalgithub.com/mattermost/mattermost-server/v6GoMattermost Guest User Information Disclosure Vulnerability3.1 Low- Show moreLoading…