Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 507

Export CSV
CVE-2024-47003

DoS via non-string message using permalink embed

Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Server
CVE-2024-45843

Weak SSRF Filtering

Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Server
CVE-2024-39837

Malicious remote can create arbitrary channels

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, when shared channels were enabled.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Server
CVE-2024-39839

Remote username set to an arbitrary string by remote user

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow users to set their own remote username, when shared channels were enabled, which allows a user on a remote to set their remote username prop to an arbitrary string, which would be then synced to the local server as long as the user hadn't been synced before.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Server
CVE-2024-41144

Malicious remote can create/update/delete arbitrary posts in arbitrary channels

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly validate synced posts, when shared channels are enabled,  which allows a malicious remote to create/update/delete arbitrary posts in arbitrary channels

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Server
CVE-2024-41162

Malicious remote can make an arbitrary local channel read-only

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote, when shared channels are enabled, which allows a malicious remote to make an arbitrary local channel read-only.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Server
CVE-2024-41926

Malicious remote can claim that a user was synced from another remote

Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Server