mattermost mattermost vulnerabilities and exploits

(subscribe to this query)

4.3

CVSSv3

Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an malicious user to modify the contents of the post sent by the Apps.

Mattermost Mattermost Mattermost Mattermost 7.10.0

6.5

CVSSv3

Mattermost fails to verify if the requestor is a sysadmin or not, before allowing `install` requests to the Apps allowing a regular user send install requests to the Apps.

Mattermost Mattermost Mattermost Mattermost 7.10.0

6.1

CVSSv3

Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providing a invalid custom url scheme in /oauth/{service}/mobile_login?redirect_to=

Mattermost Mattermost Mattermost Mattermost 9.1.0

4.9

CVSSv3

Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.

Mattermost Mattermost Mattermost Mattermost 9.0.0

5.3

CVSSv3

Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_location, to fill up the memory due to caching large items.

Mattermost Mattermost Mattermost Mattermost 9.0.0

7.5

CVSSv3

Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a malicious user to consume excessive resources, possibly leading to Denial of Service, by patching the field of a block using a specially crafted string.

Mattermost Mattermost Mattermost Mattermost 9.1.0

4.3

CVSSv3

An issue exists in Mattermost Server prior to 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case.

Mattermost Mattermost Server Mattermost Mattermost Server 4.5.0

5.3

CVSSv3

An issue exists in Mattermost Server prior to 4.3.0, 4.2.1, and 4.1.2. It allows malicious users to cause a denial of service (channel invisibility) via a misformatted post.

Mattermost Mattermost Server Mattermost Mattermost Server 4.3.0

4.9

CVSSv3

An issue exists in Mattermost Server prior to 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.

Mattermost Mattermost Server Mattermost Mattermost Server 4.3.0

6.1

CVSSv3

An issue exists in Mattermost Server prior to 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.

Mattermost Mattermost Server Mattermost Mattermost Server 4.3.0

Get Started

« PREV 1 2 3 4 5 6 7 8 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook