Skip to contentMattermost Server vulnerabilities
- mattermost, mattermost server +1 moreZipbomb DoS via Missing Slack Import ValidationCVE-2024-54682Fix available6.5 Medium
- mattermost, mattermost server +1 moreDoS via lack of type validation in CallsCVE-2024-54083Fix available6.5 Medium
- mattermost, mattermost server +1 moreBypass of "Max failed attempts" restriction via race conditionCVE-2024-48872Fix available4.8 Medium
- mattermost, mattermost server +1 moreImproper propagation of permission scheme updates across cluster nodesCVE-2024-122474.6 Medium
- mattermost, mattermost server +1 moreDomain Restriction Bypass on RegistrationCVE-2024-115998.2 High
- mattermost, mattermost server +1 morePrivate channel names leaking when Elasticsearch is enabledCVE-2024-52032Fix available4.3 Medium
- mattermost, mattermost server +1 moreMFA Code ReplayCVE-2024-36250Fix available3.1 Low
- mattermost, mattermost server +1 moreUnauthorized Access to view channels' detailsCVE-2024-42000Fix available2.7 Low
- mattermost, mattermost server +1 moreClient-Side Path Traversal Leading to CSRF in PlaybooksCVE-2024-46872Fix available4.6 Medium
- mattermost, mattermost server +1 moreDoS via Amplified GraphQL Response in PlaybooksCVE-2024-47401Fix available4.3 Medium
- mattermost, mattermost server +1 moreArbitrary post deletion via Playbooks /ignore-thread endpointCVE-2024-50052Fix available4.3 Medium
- mattermost, mattermost server +1 morePrivate channel names leaked with Ctrl+K when ElasticSearch is enabledCVE-2024-10241Fix available4.3 Medium
- mattermost, mattermost server +1 moreInsufficient Authorization On Unlinked Channel FilesCVE-2024-91554.3 Medium
- mattermost, mattermost server +1 moreDoS via non-string message using permalink embedCVE-2024-47003Fix available3.1 Low
- mattermost, mattermost server +1 moreUnauthorized access on archived channelsCVE-2024-42406Fix available5.4 Medium
- mattermost, mattermost server +1 moreWeak SSRF FilteringCVE-2024-45843Fix available3.1 Low
- mattermost, mattermost server +1 moreUnauthorized access on archived channels via file linksCVE-2024-47145Fix available3.1 Low
- mattermost, mattermost server +1 moreUnauthorized channel file uploadCVE-2024-43780Fix available4.3 Medium
- mattermost, mattermost server +1 moreInsufficient permissions checks on teamsCVE-2024-42497Fix available6.0 Medium
- mattermost, mattermost server +1 moreUnauthorized disabling of invite URLCVE-2024-40884Fix available2.7 Low
- mattermost, mattermost server +1 moreMalicious remote can claim that a user was synced from another remoteCVE-2024-41926Fix available2.7 Low
- mattermost, mattermost server +1 moreMalicious remote can make an arbitrary local channel read-onlyCVE-2024-41162Fix available4.1 Medium
- mattermost, mattermost server +1 moreMalicious remote can create/update/delete arbitrary posts in arbitrary channelsCVE-2024-41144Fix available5.5 Medium
- mattermost, mattermost server +1 moreRemote username set to an arbitrary string by remote userCVE-2024-39839Fix available4.3 Medium
- mattermost, mattermost server +1 moreMalicious remote can create arbitrary channelsCVE-2024-39837Fix available3.8 Low
- mattermost, mattermost server +1 moreSlash commands run in channel without channel membership via playbook task commandsCVE-2024-292154.3 Medium
- mattermost, mattermost server +1 morePost actions can run playbook checklist task commandsCVE-2024-362555.7 Medium
- mattermost, mattermost server +1 more/playbook add slash command allows viewing arbitrary post contentsCVE-2024-362413.1 Low
- mattermost, mattermost server +1 moreMember promoted to channel admin via playbooks run linking to channelCVE-2024-318594.3 Medium
- mattermost, mattermost server +1 moreSAML to email switch possible when email signin is disabledCVE-2024-52704.3 Medium
- mattermost, mattermost server +1 moreRun Details leak to guest via webhook event "custom_playbooks_playbook_run_updated"CVE-2024-52724.3 Medium
- mattermost, mattermost server +1 morePlaybook run link to private channel grants channel accessCVE-2024-320455.9 Medium
- mattermost, mattermost server +1 morePlaybook Run Metadata leak to GuestCVE-2024-341524.3 Medium
- mattermost, mattermost server +1 moreAD/LDAP Group Members LeakCVE-2024-340294.3 Medium
- mattermost, mattermost server +1 moreMattermost fails to fully validate role changesCVE-2024-4198Fix available2.7 Low
- jenkins mattermost, mattermost server +1 moreMattermost allows team admins to promote guests to team adminsCVE-2024-4195Fix available2.7 Low
- mattermost, mattermost server +1 moreMattermost fails to limit the number of active sessionsCVE-2024-4183Fix available4.3 Medium
- mattermost, mattermost server +1 moreMattermost crashes web clients via a malformed custom statusCVE-2024-4182Fix available4.3 Medium
- mattermost, mattermost server +1 moreDetailed error discloses full file path with dev mode offCVE-2024-32046Fix available4.3 Medium
- mattermost, mattermost server +1 moreExcessive resource consumption due to lack to request path size limitsCVE-2024-22091Fix available3.1 Low
- mattermost, mattermost server +1 moreMattermost fails to authenticate the source of certain types of post actionsCVE-2024-2447Fix available6.5 Medium
- mattermost, mattermost server +1 moreInvite ID available to team admins even without the "Add Members" permissionCVE-2024-29221Fix available4.7 Medium
- mattermost, mattermost server +1 moreDoS via a large number of User PreferencesCVE-2024-28949Fix available4.3 Medium
- mattermost, mattermost server +1 moreUsers maintain access to active call after being removed from a channelCVE-2024-21848Fix available3.1 Low
- mattermost, mattermost server +1 moreReflected XSS in Mattermost Jira pluginCVE-2024-2445Fix available6.1 Medium
- mattermost, mattermost server +1 moreMattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before...CVE-2024-2450Fix available8.8 High
- mattermost, mattermost server +1 moreMattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before...CVE-2024-2446Fix available4.3 Medium
- mattermost, mattermost server +1 moreResource Exhaustion via the Invitation FeatureCVE-2024-28053Fix available3.1 Low
- mattermost, mattermost server +1 moreMattermost fails to limit the number of role namesCVE-2024-1953Fix available4.3 Medium
- mattermost, mattermost server +1 moreMattermost incorrectly allows access individual postsCVE-2024-1952Fix available3.1 Low
- Show moreLoading…