Summary
Detail | |||
---|---|---|---|
Vendor | Mattermost | First view | 2020-06-19 |
Product | Mattermost Server | Last view | 2024-10-29 |
Version | 5.18.0 | Type | Application |
Update | rc1 | ||
Edition | * | ||
Language | * | ||
Sofware Edition | * | ||
Target Software | * | ||
Target Hardware | * | ||
Other | * | ||
CPE Product | cpe:2.3:a:mattermost:mattermost_server |
Activity : Overall
Related : CVE
Date | Alert | Description | |
---|---|---|---|
4.6 | 2024-10-29 | CVE-2024-46872 | Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks |
4.3 | 2024-09-26 | CVE-2024-47145 | Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links. |
6.5 | 2024-09-26 | CVE-2024-47003 | Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend. |
5.4 | 2024-09-26 | CVE-2024-45843 | Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba. |
5.4 | 2024-09-26 | CVE-2024-42406 | Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files. |
4.3 | 2024-08-22 | CVE-2024-43780 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel. |
4.9 | 2024-08-22 | CVE-2024-42497 | Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams. |
2.7 | 2024-08-22 | CVE-2024-40884 | Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL. |
4.3 | 2024-08-01 | CVE-2024-41926 | Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote. |
4.3 | 2024-08-01 | CVE-2024-41162 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote, when shared channels are enabled, which allows a malicious remote to make an arbitrary local channel read-only. |
7.1 | 2024-08-01 | CVE-2024-41144 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly validate synced posts, when shared channels are enabled,  which allows a malicious remote to create/update/delete arbitrary posts in arbitrary channels |
4.3 | 2024-08-01 | CVE-2024-39839 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow users to set their own remote username, when shared channels were enabled, which allows a user on a remote to set their remote username prop to an arbitrary string, which would be then synced to the local server as long as the user hadn't been synced before. |
5.4 | 2024-08-01 | CVE-2024-39837 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, when shared channels were enabled. |
4.3 | 2024-02-09 | CVE-2024-24776 | Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a user without permissions. |
4.1 | 2024-02-09 | CVE-2024-24774 | Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues. |
3.5 | 2024-02-09 | CVE-2024-23319 | Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message. |
4.3 | 2024-02-09 | CVE-2024-1402 | Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, allowing an attacker sending a huge amount of non-existent custom emojis in a post to crash the mobile app of a user seeing the post and to crash the server due to overloading when clients attempt to retrive the aforementioned post. |
4.3 | 2024-01-02 | CVE-2023-50333 | Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names. |
4.3 | 2024-01-02 | CVE-2023-48732 | Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel. |
4.3 | 2024-01-02 | CVE-2023-47858 | Mattermost fails to properly verify the permissions needed for viewing archived public channels,  allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams/ |
6.1 | 2023-12-29 | CVE-2023-7113 | Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client. |
4.3 | 2023-12-12 | CVE-2023-6727 | Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbook action created is to post a message in a channel based on specific keywords in a post, some playbook information, like the name, can be leaked. |
5.4 | 2023-12-12 | CVE-2023-6547 | Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to the team the playbook is on to access and modify the playbook. This can happen if the user was once a member of the team, got permissions to the playbook and was then removed from the team. |
4.3 | 2023-12-12 | CVE-2023-49874 | Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know the run ID. |
6.5 | 2023-12-12 | CVE-2023-49809 | Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and make it crash. After a few repetitions, the plugin is disabled. |
CWE : Common Weakness Enumeration
% | id | Name |
---|---|---|
13% (6) | CWE-400 | Uncontrolled Resource Consumption ('Resource Exhaustion') |
9% (4) | CWE-668 | Exposure of Resource to Wrong Sphere |
9% (4) | CWE-352 | Cross-Site Request Forgery (CSRF) |
6% (3) | CWE-770 | Allocation of Resources Without Limits or Throttling |
6% (3) | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') |
6% (3) | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path ... |
4% (2) | CWE-787 | Out-of-bounds Write |
4% (2) | CWE-754 | Improper Check for Unusual or Exceptional Conditions |
4% (2) | CWE-346 | Origin Validation Error |
4% (2) | CWE-200 | Information Exposure |
4% (2) | CWE-74 | Failure to Sanitize Data into a Different Plane ('Injection') |
4% (2) | CWE-20 | Improper Input Validation |
2% (1) | CWE-639 | Access Control Bypass Through User-Controlled Key |
2% (1) | CWE-434 | Unrestricted Upload of File with Dangerous Type |
2% (1) | CWE-345 | Insufficient Verification of Data Authenticity |
2% (1) | CWE-319 | Cleartext Transmission of Sensitive Information |
2% (1) | CWE-287 | Improper Authentication |
2% (1) | CWE-281 | Improper Preservation of Permissions |
2% (1) | CWE-276 | Incorrect Default Permissions |
2% (1) | CWE-269 | Improper Privilege Management |
2% (1) | CWE-89 | Improper Sanitization of Special Elements used in an SQL Command ('... |