Skip to contentMattermost vulnerabilities
Newest
- mattermost, mattermost server +1 moreMember can create team with team override schemeCVE-2023-3584Fix available3.1 Low
- mattermost, mattermost server +1 moreLack of channel membership check when linking a board to a channelCVE-2023-3582Fix available4.3 Medium
- mattermost, mattermost server +1 moreWebSockets accept connections from HTTPS originCVE-2023-3581Fix available6.2 Medium
- mattermost, mattermost server +1 moreLimited blind SSRF to localhost/intranet in interactive dialog implementationCVE-2023-3577Fix available3.5 Low
- mattermostSpecially crafted search query can cause large log entries in postgresCVE-2023-27854.3 Medium
- mattermostDenial of Service while unescaping a Markdown stringCVE-2023-28314.3 Medium
- mattermost, mattermost github plugin +1 morePath traversal in GitHub plugin's code preview featureCVE-2023-27973.1 Low
- mattermostStack exhaustion in PreparePostForClientWithEmbedsAndImagesCVE-2023-27936.5 Medium
- mattermostEphemeral messages return private channel contents in permalink previewsCVE-2023-27926.5 Medium
- mattermostPlaybooks lets you edit arbitrary postsCVE-2023-27914.3 Medium
- mattermostDeactivated user can retain access using oauth2 apiCVE-2023-27886.2 Medium
- mattermostCollapsed Reply Threads APIs leak message contents from private channelsCVE-2023-27876.5 Medium
- mattermostChannel commands execution doesn't properly verify permissionsCVE-2023-27864.3 Medium
- mattermost, mattermost app framework +1 moreApps Framework allows install requests from regular members via an internal pathCVE-2023-27844.2 Medium
- mattermost, mattermost app framework +1 moreApp Framework does not checks for the secret provided in the incoming webhook requestCVE-2023-2783Fix available4.3 Medium
- mattermostLack of URL normalization allows rendering previews for disallowed domainsCVE-2023-28084.3 Medium
- mattermostDB username/password revealed in application logsCVE-2023-25146.7 Medium
- mattermost, mattermost server +1 morePrivilege escalation to system admin via personal access tokensCVE-2023-2515Fix available4.7 Medium
- mattermost, mattermost desktop +1 moreUnrestricted navigation due to unvalidated mattermost server redirectionCVE-2023-20005.4 Medium
- mattermost, mattermost server +1 moreArchiving a team broadcasts unsanitized data over WebSocketsCVE-2023-2281Fix available3.1 Low
- mattermostOauth authorization codes do not expire when deauthorizing an oauth2 appCVE-2023-21936.5 Medium
- mattermost, mattermost server +1 moreUser password logged in audit logsCVE-2023-1831Fix available7.2 High
- mattermost, mattermost server +1 moreInformation disclosure in linked message previewsCVE-2023-1777Fix available6.5 Medium
- mattermost, mattermost server +1 moreStored XSS via SVG attachment on BoardsCVE-2023-1776Fix available7.3 High
- mattermost, mattermost server +1 moreUnsanitized events sent over Websocket to regular users in a High Availability environmentCVE-2023-1775Fix available4.3 Medium
- mattermost, mattermost server +1 moreUnauthorized email invite to a private channelCVE-2023-1774Fix available4.2 Medium
- mattermostFull name revealed via /plugins/focalboard/api/v2/usersCVE-2023-15623.5 Low
- mattermost, mattermost server +1 moreReflected XSS in OAuth flow completion endpointsCVE-2023-1421Fix available3.5 Low
- mattermost, mattermost server +1 moreDisclosure of team owner email address when when accessing the teams APICVE-2023-27266Fix available2.7 Low
- mattermost, mattermost server +1 moreDisclosure of team owner email address when regenerating Invite IDCVE-2023-27265Fix available2.7 Low
- mattermostIDOR: Updating a playbook via the Playbooks APICVE-2023-272647.1 High
- mattermostIDOR: Accessing playbook runs via the Playbooks Runs APICVE-2023-272634.3 Medium
- mattermostAuthenticated user could send multiple requests containing a parameter which could fetch a large amount of data and can crash a Mattermost serverCVE-2022-4045Fix available3.1 Low
- mattermostAuthenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost serverCVE-2022-4044Fix available4.3 Medium
- mattermost, mattermost playbooks plugin +1 moreAuthenticated user could send multiple requests containing a large payload to a Playbooks API and can crash a Mattermost serverCVE-2022-40194.3 Medium
- mattermost, mattermost server +1 moreServer-side Denial of Service while processing a specifically crafted GIF fileCVE-2022-3257Fix available3.1 Low
- mattermost, mattermost server +1 moreServer-side Denial of Service while processing a specifically crafted JPEG fileCVE-2022-3147Fix available3.1 Low
- mattermostGuest accounts can list all public channelsCVE-2022-24084.3 Medium
- mattermostMalicious imports can lead to Denial of ServiceCVE-2022-24064.3 Medium
- mattermost, mattermost server +1 moreTeam members could access sensitive information of other users via an API callCVE-2022-2401Fix available6.5 Medium
- mattermost, mattermost server +1 moreIncorrect defaults can cause attackers to bypass rate limitationsCVE-2022-2366Fix available5.6 Medium
- mattermost, mattermost server +1 moreA crafted SVG attachment can crash a Mattermost serverCVE-2022-1982Fix available4.3 Medium
- mattermost playbooksPlaybook members are allowed to escalate their membership privileges and perform actions restricted to playbook admins.CVE-2022-15483.7 Low
- mattermost, mattermost server +1 moreAuthorized users are allowed to install old plugin versions from the MarketplaceCVE-2022-1384Fix available4.7 Medium
- mattermost, mattermost server +1 moreInvitation Email is resent as a Reminder after invalidating pending email invitesCVE-2022-1385Fix available3.7 Low
- mattermost, mattermost server +1 moreRestricted custom admin role can bypass the restrictions and view the server logs and server config.json file contentsCVE-2022-1332Fix available4.3 Medium
- mattermost playbooksA specifically drafted Playbook could trigger large amount of webhook requests leading to Denial of ServiceCVE-2022-13333.5 Low
- mattermost, mattermost server +1 moreOOM DoS in Mattermost image proxyCVE-2022-1337Fix available4.3 Medium
- mattermostHTML Injection while inviting GuestsCVE-2022-10022.0 Low
- mattermostSysadmin can override existing configs & bypass restrictions like EnableUploadsCVE-2022-10033.3 Low
- Show moreLoading…