Mattermost
by Mattermost
Source repositories
CVEs (597)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-20885 | Hig | 0.49 | 7.5 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file. | ||
| CVE-2019-20880 | Hig | 0.49 | 7.5 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. It allows attackers to cause a denial of service (memory consumption) via OpenGraph. | ||
| CVE-2018-21262 | Hig | 0.49 | 7.5 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.7.3. It allows attackers to cause a denial of service (application crash) via invalid LaTeX text. | ||
| CVE-2018-21248 | Hig | 0.49 | 7.5 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials. | ||
| CVE-2017-18871 | Hig | 0.49 | 7.5 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name. | ||
| CVE-2019-20874 | Hig | 0.49 | 7.5 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during a role change. | ||
| CVE-2019-20871 | Hig | 0.49 | 7.5 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic backtracking. | ||
| CVE-2020-14459 | Hig | 0.49 | 7.5 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002. | ||
| CVE-2020-14458 | Hig | 0.49 | 7.5 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 5.19.0. Attackers can discover private channels via the "get channel by name" API, aka MMSA-2020-0004. | ||
| CVE-2020-14453 | Hig | 0.49 | 7.5 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not appropriately restricted, which allows attackers to cause a denial of service, aka MMSA-2020-0005. | ||
| CVE-2020-14450 | Hig | 0.49 | 7.5 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 5.22.0. The markdown renderer allows attackers to cause a denial of service (client-side), aka MMSA-2020-0017. | ||
| CVE-2020-14448 | Hig | 0.49 | 7.5 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-0020. | ||
| CVE-2020-14447 | Hig | 0.49 | 7.5 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-0021. | ||
| CVE-2019-20846 | Hig | 0.49 | 7.5 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 5.18.0. It has weak permissions for server-local file storage. | ||
| CVE-2019-20845 | Hig | 0.49 | 7.5 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 5.18.0. It allows attackers to cause a denial of service (memory consumption) via a large Slack import. | ||
| CVE-2019-20843 | Hig | 0.49 | 7.5 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There are weak permissions for configuration files. | ||
| CVE-2024-36492 | Hig | 0.48 | 7.4 | 0.00 | Aug 1, 2024 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow the modification of local users when syncing users in shared channels. which allows a malicious remote to overwrite an existing local user. | ||
| CVE-2019-20881 | Hig | 0.48 | 7.3 | 0.01 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA. | ||
| CVE-2026-9816 | Hig | 0.47 | 8.3 | 0.00 | Aug 17, 2026 | Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST… | ||
| CVE-2023-45316 | Hig | 0.47 | 7.3 | 0.00 | Dec 12, 2023 | Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker to use a path traversal payload that points to a different endpoint leading to a CSRF attack. |
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. It allows attackers to cause a denial of service (memory consumption) via OpenGraph.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Mattermost Server before 4.7.3. It allows attackers to cause a denial of service (application crash) via invalid LaTeX text.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during a role change.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic backtracking.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Mattermost Server before 5.19.0. Attackers can discover private channels via the "get channel by name" API, aka MMSA-2020-0004.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not appropriately restricted, which allows attackers to cause a denial of service, aka MMSA-2020-0005.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Mattermost Server before 5.22.0. The markdown renderer allows attackers to cause a denial of service (client-side), aka MMSA-2020-0017.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-0020.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-0021.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Mattermost Server before 5.18.0. It has weak permissions for server-local file storage.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Mattermost Server before 5.18.0. It allows attackers to cause a denial of service (memory consumption) via a large Slack import.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There are weak permissions for configuration files.
- risk 0.48cvss 7.4epss 0.00
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow the modification of local users when syncing users in shared channels. which allows a malicious remote to overwrite an existing local user.
- risk 0.48cvss 7.3epss 0.01
An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA.
- risk 0.47cvss 8.3epss 0.00
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST…
- risk 0.47cvss 7.3epss 0.00
Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker to use a path traversal payload that points to a different endpoint leading to a CSRF attack.
Page 3 of 30