Boards
by Mattermost
CVEs (4)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-3590 | 0.00 | — | 0.00 | Jul 17, 2023 | Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments. | |||
| CVE-2023-3585 | 0.00 | — | 0.00 | Jul 17, 2023 | Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link. | |||
| CVE-2021-37867 | 0.00 | — | 0.01 | Jan 18, 2022 | Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive & private information disclosure. | |||
| CVE-2021-37866 | 0.00 | — | 0.01 | Jan 18, 2022 | Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization. |
- CVE-2023-3590Jul 17, 2023risk 0.00cvss —epss 0.00
Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments.
- CVE-2023-3585Jul 17, 2023risk 0.00cvss —epss 0.00
Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link.
- CVE-2021-37867Jan 18, 2022risk 0.00cvss —epss 0.01
Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive & private information disclosure.
- CVE-2021-37866Jan 18, 2022risk 0.00cvss —epss 0.01
Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization.