Github.Com Mattermost Mattermost-Server vulnerabilities
222 known vulnerabilities affecting github.com/mattermost_mattermost-server.
Total CVEs
222
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL10HIGH18MEDIUM100LOW22UNKNOWN72
Vulnerabilities
Page 10 of 12
CVE-2017-18905MEDIUM≥ 0, < 3.9.2≥ 3.10.0, < 3.10.22022-05-24
CVE-2017-18905 [MEDIUM] CWE-613 Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider
Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.
ghsaosv
CVE-2017-18874MEDIUM≥ 0, < 4.1.2-0.20171004201910-6be8113eb60≥ 4.2.0-rc1, < 4.2.1-0.20171004194140-6d3cb2ce07fc+1 more2022-05-24
CVE-2017-18874 [MEDIUM] CWE-22 Mattermost Server is vulnerable to Directory Traversal by System Admins
Mattermost Server is vulnerable to Directory Traversal by System Admins
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal.
ghsaosv
CVE-2016-11068MEDIUM≥ 0, < 3.2.02022-05-24
CVE-2016-11068 [MEDIUM] Mattermost Server is vulnerable to Code Injection through its LDAP fields
Mattermost Server is vulnerable to Code Injection through its LDAP fields
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.
ghsaosv
CVE-2016-11071MEDIUM≥ 0, < 3.1.02022-05-24
CVE-2016-11071 [MEDIUM] CWE-79 Mattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener`
Mattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener`
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.
ghsaosv
CVE-2017-18873MEDIUM≥ 0, < 4.1.2-0.20171013141717-ee57a5829ab1≥ 4.2.0, < 4.2.1-0.20171013140502-b3e4b0ac9168+1 more2022-05-24
CVE-2017-18873 [MEDIUM] CWE-20 Mattermost Server is vulnerable to channel invisibility DoS via misformatted post
Mattermost Server is vulnerable to channel invisibility DoS via misformatted post
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misformated post.
ghsaosv
CVE-2017-18887MEDIUM≥ 0, < 4.1.2≥ 4.2.0-rc1, < 4.2.1+1 more2022-05-24
CVE-2017-18887 [MEDIUM] CWE-200 Mattermost Server exposes team creator's e-mail address to other members
Mattermost Server exposes team creator's e-mail address to other members
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members.
ghsaosv
CVE-2017-18889MEDIUM≥ 0, < 4.1.2≥ 4.2.0-rc1, < 4.2.1+1 more2022-05-24
CVE-2017-18889 [MEDIUM] CWE-20 Mattermost Server is vulnerable to webhook and slash command manipulation
Mattermost Server is vulnerable to webhook and slash command manipulation
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API.
ghsaosv
CVE-2016-11073MEDIUM≥ 0, < 3.0.02022-05-24
CVE-2016-11073 [MEDIUM] CWE-79 Mattermost Server is vulnerable to XSS via a Legal or Support setting
Mattermost Server is vulnerable to XSS via a Legal or Support setting
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.
ghsaosv
CVE-2016-11063MEDIUM≥ 0, < 3.5.12022-05-24
CVE-2016-11063 [MEDIUM] CWE-79 Mattermost Server vulnerable to Cross-site Scripting through file preview feature
Mattermost Server vulnerable to Cross-site Scripting through file preview feature
An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.
ghsaosv
CVE-2017-18907MEDIUM≥ 0, < 3.9.2-0.20170714014920-312269ad0bd1≥ 3.10.0, < 3.10.22022-05-24
CVE-2017-18907 [MEDIUM] CWE-79 Mattermost Server vulnerable to XSS through channel headers
Mattermost Server vulnerable to XSS through channel headers
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.
ghsaosv
CVE-2017-18883MEDIUM≥ 0, < 4.1.2≥ 4.2.0-rc1, < 4.2.1+1 more2022-05-24
CVE-2017-18883 [MEDIUM] CWE-331 Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider
Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.
ghsaosv
CVE-2016-11079MEDIUM≥ 0, < 3.0.02022-05-24
CVE-2016-11079 [MEDIUM] CWE-79 Mattermost Server allows XSS via redirect URL
Mattermost Server allows XSS via redirect URL
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.
ghsaosv
CVE-2017-18876MEDIUM≥ 0, < 4.1.2-0.20171004201910-6be8113eb60c≥ 4.2.0-rc1.0.20171004154238-fadd9514f6e7, < 4.2.1-0.20171004194140-6d3cb2ce07fc+1 more2022-05-24
CVE-2017-18876 [MEDIUM] CWE-22 Mattermost Server is vulnerable to Path Traversal when files are stored locally
Mattermost Server is vulnerable to Path Traversal when files are stored locally
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file.
ghsaosv
CVE-2016-11082MEDIUM≥ 0, < 2.2.02022-05-24
CVE-2016-11082 [MEDIUM] CWE-79 Mattermost Server is vulnerable to XSS through crafted links
Mattermost Server is vulnerable to XSS through crafted links
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.
ghsaosv
CVE-2017-18878MEDIUM≥ 0, < 4.1.2-0.20171004201910-6be8113eb60c≥ 4.2.0-rc1, < 4.2.1-0.20171004192657-8fbbd688ea24+1 more2022-05-24
CVE-2017-18878 [MEDIUM] CWE-284 Mattermost Server allows users with a session ID to revoke another users' session
Mattermost Server allows users with a session ID to revoke another users' session
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.
ghsaosv
CVE-2016-11084MEDIUM≥ 0, < 2.1.02022-05-24
CVE-2016-11084 [MEDIUM] CWE-352 Mattermost Server allows XSS via CSRF
Mattermost Server allows XSS via CSRF
An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.
ghsaosv
CVE-2017-18879MEDIUM≥ 0, < 4.1.2≥ 4.2.0, < 4.2.1+1 more2022-05-24
CVE-2017-18879 [MEDIUM] CWE-79 Mattermost Server is vulnerable to XSS through author_link field in Slack attachments
Mattermost Server is vulnerable to XSS through author_link field in Slack attachments
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment.
ghsaosv
CVE-2017-18916MEDIUM≥ 0, < 3.6.7-0.20170420152529-0968e4079e0a≥ 3.7.0, < 3.7.5+1 more2022-05-24
CVE-2017-18916 [MEDIUM] CWE-284 Mattermost Server has Improper Authorization for Integration Requests
Mattermost Server has Improper Authorization for Integration Requests
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.
ghsaosv
CVE-2017-18902MEDIUM≥ 0, < 3.10.3≥ 4.0.0, < 4.0.4+1 more2022-05-24
CVE-2017-18902 [MEDIUM] CWE-200 Mattermost Server exposes team invite IDs through API endpoints
Mattermost Server exposes team invite IDs through API endpoints
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover team invite IDs via team API endpoints.
ghsaosv
CVE-2017-18898MEDIUM≥ 0, < 4.0.5≥ 4.1.0, < 4.1.1+1 more2022-05-24
CVE-2017-18898 [MEDIUM] CWE-404 Mattermost Server is vulnerable to DoS through maliciously crafted posts
Mattermost Server is vulnerable to DoS through maliciously crafted posts
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts that potentially cause a web browser to hang.
ghsaosv