Skip to contentMattermost vulnerabilities
Newest
- mattermostRemoteClusterFrame payloads are audit logged in fullCVE-2024-393532.7 Low
- mattermostCreating posts with user-defined IDs permitted in CreatePost APICVE-2024-393613.1 Low
- mattermostTiming attack during remote cluster token comparison when shared channels are enabledCVE-2024-398308.1 High
- mattermostChannel IDs of archived/restored channels leaked via webhook eventsCVE-2024-398073.1 Low
- mattermostLack of permission check when updating the profile picture of a remote user (shared channels enabled)CVE-2024-362572.7 Low
- mattermost, mattermost desktop +1 moreLack of permissions prompting when opening external URLsCVE-2024-37182Fix available4.7 Medium
- mattermost, mattermost desktop +1 moreBypass of TCC restrictions on macOSCVE-2024-36287Fix available3.8 Low
- mattermost, mattermost server +1 moreSlash commands run in channel without channel membership via playbook task commandsCVE-2024-292154.3 Medium
- mattermost, mattermost server +1 morePost actions can run playbook checklist task commandsCVE-2024-362555.7 Medium
- mattermost, mattermost server +1 more/playbook add slash command allows viewing arbitrary post contentsCVE-2024-362413.1 Low
- mattermost, mattermost server +1 moreMember promoted to channel admin via playbooks run linking to channelCVE-2024-318594.3 Medium
- mattermost, mattermost server +1 moreSAML to email switch possible when email signin is disabledCVE-2024-52704.3 Medium
- mattermost, mattermost server +1 moreRun Details leak to guest via webhook event "custom_playbooks_playbook_run_updated"CVE-2024-52724.3 Medium
- mattermost, mattermost server +1 morePlaybook run link to private channel grants channel accessCVE-2024-320455.9 Medium
- mattermost, mattermost server +1 morePlaybook Run Metadata leak to GuestCVE-2024-341524.3 Medium
- mattermost, mattermost server +1 moreAD/LDAP Group Members LeakCVE-2024-340294.3 Medium
- mattermost, mattermost server +1 moreMattermost fails to fully validate role changesCVE-2024-4198Fix available2.7 Low
- jenkins mattermost, mattermost server +1 moreMattermost allows team admins to promote guests to team adminsCVE-2024-4195Fix available2.7 Low
- mattermost, mattermost server +1 moreMattermost fails to limit the number of active sessionsCVE-2024-4183Fix available4.3 Medium
- mattermost, mattermost server +1 moreMattermost crashes web clients via a malformed custom statusCVE-2024-4182Fix available4.3 Medium
- mattermost, mattermost server +1 moreDetailed error discloses full file path with dev mode offCVE-2024-32046Fix available4.3 Medium
- mattermost, mattermost server +1 moreExcessive resource consumption due to lack to request path size limitsCVE-2024-22091Fix available3.1 Low
- mattermost, mattermost mobile +1 moreMattermost Mobile app versions 2.13.0 and earlier use a regular expression with polynomial...CVE-2024-38723.1 Low
- mattermost, mattermost server +1 moreMattermost fails to authenticate the source of certain types of post actionsCVE-2024-2447Fix available6.5 Medium
- mattermost, mattermost server +1 moreInvite ID available to team admins even without the "Add Members" permissionCVE-2024-29221Fix available4.7 Medium
- mattermost, mattermost server +1 moreDoS via a large number of User PreferencesCVE-2024-28949Fix available4.3 Medium
- mattermost, mattermost server +1 moreUsers maintain access to active call after being removed from a channelCVE-2024-21848Fix available3.1 Low
- mattermost, mattermost server +1 moreReflected XSS in Mattermost Jira pluginCVE-2024-2445Fix available6.1 Medium
- mattermost, mattermost server +1 moreMattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before...CVE-2024-2450Fix available8.8 High
- mattermost, mattermost server +1 moreMattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before...CVE-2024-2446Fix available4.3 Medium
- mattermost, mattermost server +1 moreResource Exhaustion via the Invitation FeatureCVE-2024-28053Fix available3.1 Low
- mattermost mobileDenial of Service for mobile app users due to automatic code highlightingCVE-2024-249753.5 Low
- mattermost, mattermost server +1 moreMattermost fails to limit the number of role namesCVE-2024-1953Fix available4.3 Medium
- mattermost, mattermost server +1 moreMattermost incorrectly allows access individual postsCVE-2024-1952Fix available3.1 Low
- mattermost, mattermost server +1 moreMattermost race conditionCVE-2024-1949Fix available2.6 Low
- mattermost, mattermost server +1 moreMattermost allows attackers access to posts in channels they are not a member ofCVE-2024-1942Fix available4.3 Medium
- mattermost, mattermost server +1 moreExisting server guests invited to the team by members without "invite_guest" permissionCVE-2024-1888Fix available4.3 Medium
- mattermost, mattermost server +1 moreExcessive resource consumption when sending long emoji names in user custom statusCVE-2024-24988Fix available4.3 Medium
- mattermost, mattermost server +1 morePublic channel post content accessible without membership when compliance export is enabledCVE-2024-1887Fix available4.3 Medium
- mattermost, mattermost server +1 moreFiles of archived channels accessible with the “Allow users to view archived channels” option disabledCVE-2024-23488Fix available3.1 Low
- mattermost, mattermost server +1 moreTeam associated AD/LDAP Groups Leaked due to missing authorizationCVE-2024-23493Fix available4.3 Medium
- mattermost, mattermost server +1 moreDenial of service in mattermost mobile apps and server via emoji reactionsCVE-2024-1402Fix available4.3 Medium
- mattermost, mattermost server +1 moreIncorrect Authorization leads to Channel Member Count LeakCVE-2024-24776Fix available3.1 Low
- mattermost, mattermost server +1 moreMissing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin)CVE-2024-24774Fix available3.4 Low
- mattermost, mattermost server +1 moreCSRF issue allows disconnecting a user's Jira connection through a simple post message (Jira Plugin)CVE-2024-23319Fix available3.5 Low
- mattermost, mattermost server +1 moreDetails of archived public channels are leaked to members of another teamCVE-2023-47858Fix available4.3 Medium
- mattermost, mattermost server +1 moreLack of restriction to manage group names for freshly demoted guestsCVE-2023-50333Fix available3.7 Low
- mattermost, mattermost server +1 moreKeywords that trigger mentions are leaked to other usersCVE-2023-48732Fix available4.3 Medium
- mattermostMattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker...CVE-2023-71147.1 High
- mattermost, mattermost server +1 moreMattermost Cross-site Scripting vulnerabilityCVE-2023-7113Fix available3.7 Low
- Show moreLoading…