Go modules package
github.com/mattermost/mattermost-server
pkg:golang/github.com/mattermost/mattermost-server
Vulnerabilities (152)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2017-18884 | — | < 4.1.2 | 4.1.2 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens. | ||
| CVE-2017-18883 | — | < 4.1.2 | 4.1.2 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data. | ||
| CVE-2017-18879 | — | < 4.1.2 | 4.1.2 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment. | ||
| CVE-2017-18878 | — | < 4.1.2-0.20171004201910-6be8113eb60c | 4.1.2-0.20171004201910-6be8113eb60c | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session. | ||
| CVE-2017-18874 | — | < 4.1.2-0.20171004201910-6be8113eb60 | 4.1.2-0.20171004201910-6be8113eb60 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal. | ||
| CVE-2017-18873 | — | < 4.1.2-0.20171013141717-ee57a5829ab1 | 4.1.2-0.20171013141717-ee57a5829ab1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misformatted post. | ||
| CVE-2017-18872 | — | < 4.3.3 | 4.3.3 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider. | ||
| CVE-2017-18871 | — | < 4.2.2 | 4.2.2 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name. | ||
| CVE-2017-18877 | — | < 4.1.2 | 4.1.2 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page. | ||
| CVE-2017-18876 | — | < 4.1.2-0.20171004201910-6be8113eb60c | 4.1.2-0.20171004201910-6be8113eb60c | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file. | ||
| CVE-2017-18875 | — | < 4.1.2-0.20171004201910-6be8113eb60c | 4.1.2-0.20171004201910-6be8113eb60c | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files. | ||
| CVE-2018-21258 | — | < 5.1.0 | 5.1.0 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash command. |
- CVE-2017-18884Jun 19, 2020affected < 4.1.2fixed 4.1.2
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens.
- CVE-2017-18883Jun 19, 2020affected < 4.1.2fixed 4.1.2
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.
- CVE-2017-18879Jun 19, 2020affected < 4.1.2fixed 4.1.2
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment.
- CVE-2017-18878Jun 19, 2020affected < 4.1.2-0.20171004201910-6be8113eb60cfixed 4.1.2-0.20171004201910-6be8113eb60c
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.
- CVE-2017-18874Jun 19, 2020affected < 4.1.2-0.20171004201910-6be8113eb60fixed 4.1.2-0.20171004201910-6be8113eb60
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal.
- CVE-2017-18873Jun 19, 2020affected < 4.1.2-0.20171013141717-ee57a5829ab1fixed 4.1.2-0.20171013141717-ee57a5829ab1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misformatted post.
- CVE-2017-18872Jun 19, 2020affected < 4.3.3fixed 4.3.3
An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.
- CVE-2017-18871Jun 19, 2020affected < 4.2.2fixed 4.2.2
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name.
- CVE-2017-18877Jun 19, 2020affected < 4.1.2fixed 4.1.2
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.
- CVE-2017-18876Jun 19, 2020affected < 4.1.2-0.20171004201910-6be8113eb60cfixed 4.1.2-0.20171004201910-6be8113eb60c
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file.
- CVE-2017-18875Jun 19, 2020affected < 4.1.2-0.20171004201910-6be8113eb60cfixed 4.1.2-0.20171004201910-6be8113eb60c
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.
- CVE-2018-21258Jun 19, 2020affected < 5.1.0fixed 5.1.0
An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash command.
Page 8 of 8