Filtered by vendor Mattermost Subscriptions
Filtered by product Mattermost Server Subscriptions
Total 227 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-2366 1 Mattermost 1 Mattermost Server 2024-12-07 5.6 Medium
Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers.
CVE-2022-2401 1 Mattermost 1 Mattermost Server 2024-12-07 6.5 Medium
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
CVE-2022-3147 1 Mattermost 1 Mattermost Server 2024-12-07 3.1 Low
Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to cause resource exhaustion on specific system configurations, resulting in server-side Denial of Service.
CVE-2022-3257 1 Mattermost 1 Mattermost Server 2024-12-07 3.1 Low
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.
CVE-2023-27265 1 Mattermost 1 Mattermost Server 2024-12-07 2.7 Low
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
CVE-2023-27266 1 Mattermost 1 Mattermost Server 2024-12-07 2.7 Low
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
CVE-2023-1421 1 Mattermost 1 Mattermost Server 2024-12-07 3.5 Low
A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the victim via sharing a crafted link with a malicious state parameter.
CVE-2023-1774 1 Mattermost 1 Mattermost Server 2024-12-07 4.2 Medium
When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel.
CVE-2023-1775 1 Mattermost 1 Mattermost Server 2024-12-07 4.3 Medium
When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients.
CVE-2023-1776 1 Mattermost 1 Mattermost Server 2024-12-07 7.3 High
Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file.
CVE-2023-1777 1 Mattermost 1 Mattermost Server 2024-12-07 6.5 Medium
Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.
CVE-2023-1831 1 Mattermost 1 Mattermost Server 2024-12-07 7.2 High
Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).
CVE-2023-2281 1 Mattermost 1 Mattermost Server 2024-12-07 3.1 Low
When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team.
CVE-2023-2515 1 Mattermost 1 Mattermost Server 2024-12-07 4.7 Medium
Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin
CVE-2023-45847 1 Mattermost 1 Mattermost Server 2024-12-02 4.3 Medium
Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and crash the Playbooks plugin
CVE-2024-24776 1 Mattermost 1 Mattermost Server 2024-11-21 3.1 Low
Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a user without permissions.
CVE-2024-24774 1 Mattermost 1 Mattermost Server 2024-11-21 3.4 Low
Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues.
CVE-2024-23319 1 Mattermost 1 Mattermost Server 2024-11-21 3.5 Low
Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.
CVE-2024-1402 1 Mattermost 1 Mattermost Server 2024-11-21 4.3 Medium
Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, allowing an attacker sending a huge amount of non-existent custom emojis in a post to crash the mobile app of a user seeing the post and to crash the server due to overloading when clients attempt to retrive the aforementioned post. 
CVE-2023-7113 1 Mattermost 1 Mattermost Server 2024-11-21 3.7 Low
Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.