Advisories · Technology
Mattermost.
Every CVE that names Mattermost among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.4 Medium
Unrestricted navigation due to unvalidated mattermost server redirection
- Mattermost
- Open redirect
- CVSS 3.1 Low
Archiving a team broadcasts unsanitized data over WebSockets
- Mattermost
- Information disclosure
- CVSS 6.5 Medium
Oauth authorization codes do not expire when deauthorizing an oauth2 app
- Mattermost
- Broken access control
- CVSS 7.2 High
User password logged in audit logs
- Mattermost
- Information disclosure
- CVSS 3.5 Low
Full name revealed via /plugins/focalboard/api/v2/users
- Mattermost
- Information disclosure
- CVSS 3.5 Low
Reflected XSS in OAuth flow completion endpoints
- Mattermost
- Cross-site scripting (XSS)
- CVSS 2.7 Low
Disclosure of team owner email address when when accessing the teams API
- Mattermost
- Information disclosure
- CVSS 2.7 Low
Disclosure of team owner email address when regenerating Invite ID
- Mattermost
- Information disclosure
- CVSS 7.1 High
IDOR: Updating a playbook via the Playbooks API
- Mattermost
- Broken access control
- CVSS 4.3 Medium
IDOR: Accessing playbook runs via the Playbooks Runs API
- Mattermost
- Broken access control
- CVSS 3.1 Low
Server-side Denial of Service while processing a specifically crafted JPEG file
- Mattermost
- Denial of service
- CVSS 4.3 Medium
Guest accounts can list all public channels
- Mattermost
- Information disclosure
- CVSS 4.3 Medium
Malicious imports can lead to Denial of Service
- Mattermost
- Denial of service
- CVSS 5.6 Medium
Incorrect defaults can cause attackers to bypass rate limitations
- Mattermost
- Broken access control
- CVSS 2.0 Low
HTML Injection while inviting Guests
- Mattermost
- Cross-site scripting (XSS)
- CVSS 3.3 Low
Sysadmin can override existing configs & bypass restrictions like EnableUploads
- Mattermost
- Privilege escalation
- CVSS 4.3 Medium
Stack overflow in document extractor in Mattermost
- Mattermost
- CVSS 5.3 Medium
Stack overflow in SAML login in Mattermost
- Mattermost
- CVSS 4.3 Medium
Team Creator's Email Address is disclosed to Team Members via one of the APIs
- Mattermost
- Information disclosure
- CVSS 2.6 Low
Users can view the contents of an archived channel when access is explicitly denied by the system admin
- Mattermost
- Broken access control
- CVSS 4.3 Medium
Server-side Denial of Service while processing a specifically crafted GIF file
- Mattermost
- Denial of service
- CVSS 3.5 Low
Improper input validation in Mattermost
- Mattermost
- CWE-20
- CVSS 3.7 Low
Improper check for unusual conditions in Mattermost
- Mattermost
- CWE-754
- CVSS 5.8 Medium
Sensitive information in log files in Mattermost
- Mattermost
- Information disclosure
- CVSS 7.1 High
Reflected XSS in OAuth Flow
- Mattermost
- Cross-site scripting (XSS)