Skip to contentMattermost vulnerabilities
Newest
- mattermost, mattermost server +1 moreLeak Inaccessible Playbook Information via Channel Action IDORCVE-2023-6727Fix available3.1 Low
- mattermost, mattermost server +1 moreReflected client side path traversal leading to CSRF in PlaybooksCVE-2023-45316Fix available7.3 High
- mattermost, mattermost server +1 morePlaybooks access/modification by removed team memberCVE-2023-6547Fix available3.7 Low
- mattermost, mattermost server +1 morePlaybook plugin crash via missing interface type assertionCVE-2023-49607Fix available4.3 Medium
- mattermost, mattermost server +1 moreTodo plugin gets crashed and disabled by memberCVE-2023-49809Fix available4.3 Medium
- mattermost, mattermost server +1 moreInaccessible Post Information Leak via Run Timeline IDORCVE-2023-46701Fix available6.5 Medium
- mattermost, mattermost server +1 moreIDOR when updating the tasks of a private playbook runCVE-2023-49874Fix available4.3 Medium
- mattermost, mattermost server +1 morePlaybook Plugin Crash via Run ChecklistCVE-2023-45847Fix available4.3 Medium
- mattermost, mattermost server +1 morePublic endpoint /metrics of Calls plugin reveals channel IDsCVE-2023-6459Fix available5.3 Medium
- mattermost, mattermost server +1 moreClient side path traversal due to lack of route parameters validationCVE-2023-6458Fix available7.1 High
- mattermostOpen redirect in /oauth/<service>/mobile_login?redirect_to=CVE-2023-47168Fix available4.3 Medium
- mattermostInsecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost BoardsCVE-2023-6202Fix available4.3 Medium
- mattermostPermalink previews displayed for posts in archived channels even if users are disallowed to view archived channelsCVE-2023-43754Fix available4.3 Medium
- mattermostLog Flooding due to specially crafted requests in different endpointsCVE-2023-48369Fix available4.3 Medium
- mattermostHTML injection via channel autocompleteCVE-2023-35075Fix available3.1 Low
- mattermostDenial of Service via specially crafted block fields in Mattermost BoardsCVE-2023-40703Fix available4.3 Medium
- mattermostDenial of Service via Board Import Zip BombCVE-2023-48268Fix available4.3 Medium
- mattermostUsers full name disclosure through Mattermost Boards with Show Full Name Option disabledCVE-2023-45223Fix available4.3 Medium
- mattermostUsername and Icon override can be used by members when Hardened Mode is enabledCVE-2023-47865Fix available4.3 Medium
- mattermostDenial of Service via Link Preview in /api/v4/redirect_locationCVE-2023-5969Fix available5.3 Medium
- mattermostPassword hash in response body after username updateCVE-2023-5968Public exploitFix available4.9 Medium
- mattermostDenial of Service via crashing the Calls PluginCVE-2023-5967Fix available4.3 Medium
- mattermost desktopLack Of Secure Keyboard Entry Protection in MacOS DesktopCVE-2023-59202.9 Low
- mattermost desktopLack of Hardening against media exploitation from a remote originCVE-2023-58753.7 Low
- mattermost desktopRegex DoS from a malicious server enrolled in DesktopCVE-2023-58763.1 Low
- mattermostMobile app freezes when receiving a post with hundreds of emojisCVE-2023-55224.3 Medium
- mattermost, mattermost desktop +1 moreMattermost Desktop logs all keystrokes during initial run after fresh installationCVE-2023-53394.7 Medium
- mattermost, mattermost server +1 moreDenial of Service via multiple identical User IDs in /api/v4/users/idsCVE-2023-5333Fix available4.3 Medium
- mattermost, mattermost server +1 moreFile Information Leak via IDOR in file_id in Draft PostsCVE-2023-5331Fix available4.3 Medium
- mattermost, mattermost server +1 moreDenial of Service via Opengraph Data CacheCVE-2023-5330Fix available4.3 Medium
- mattermostFull name disclosure via team top membership with Show Full Name option disabledCVE-2023-51604.3 Medium
- mattermostA system/user manager can demote / deactivate another managerCVE-2023-5194Fix available2.7 Low
- mattermostA team member can soft delete other teams that they are not part ofCVE-2023-5195Fix available6.5 Medium
- mattermostSystem Role with manage posts permission can read posts of Direct MessagesCVE-2023-5193Fix available4.9 Medium
- mattermostDoS via Channel Notification PropertiesCVE-2023-5196Fix available6.5 Medium
- mattermostA User Manager role with user edit permissions could manage/update botsCVE-2023-5159Fix available3.8 Low
- mattermost, mattermost server +1 moreParameter tampering in the registration resulting in blocked accounts to be createdCVE-2023-4478Fix available4.3 Medium
- mattermostAudit logging fails to sanitize post metadataCVE-2023-4108Fix available4.5 Medium
- mattermostIncorrect authorization allows a user manager to update a system adminCVE-2023-4107Fix available6.7 Medium
- mattermostA guest user can perform various actions on public playbooksCVE-2023-4106Fix available6.3 Medium
- mattermostAttachment of deleted message in a thread remains accessible and downloadableCVE-2023-4105Fix available3.1 Low
- mattermost, mattermost server +1 moreServer crash via a specially crafted markdown inputCVE-2023-3593Fix available4.3 Medium
- mattermost, mattermost ios app +1 moreLack of server certificate validation in websockets connectionCVE-2023-36158.1 High
- mattermost, mattermost server +1 moreDenial of Service via specially crafted gif imageCVE-2023-3614Fix available4.3 Medium
- mattermost plugins, server +1 moreGuest accounts invited and added to channels by Welcomebot pluginCVE-2023-3613Fix available3.5 Low
- mattermost, mattermost server +1 moreLack of previous password reset tokens on new token creationCVE-2023-3591Fix available4.8 Medium
- mattermost, mattermost server +1 moreDeleted attachments in Boards remain accessibleCVE-2023-3590Fix available3.1 Low
- mattermost, mattermost server +1 moreInconsistent state in UI after boards permission change by system adminCVE-2023-3587Fix available2.7 Low
- mattermost, mattermost server +1 moreDisabling publicly-shared boards does not disable existing publicly available board linksCVE-2023-3586Fix available4.2 Medium
- mattermost, mattermost server +1 morechannel DoS by sharing a boards linkCVE-2023-3585Fix available4.3 Medium
- Show moreLoading…