Vulnerabilities > Mattermost

DATE CVE VULNERABILITY TITLE RISK
2023-05-12 CVE-2023-2514 Information Exposure Through Log Files vulnerability in Mattermost
Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization. 
network
low complexity
mattermost CWE-532
7.5
2023-05-12 CVE-2023-2515 Incorrect Authorization vulnerability in Mattermost Server
Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin
network
low complexity
mattermost CWE-863
8.8
2023-05-02 CVE-2023-2000 Open Redirect vulnerability in Mattermost Desktop
Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website
network
low complexity
mattermost CWE-601
5.4
2023-04-25 CVE-2023-2281 Unspecified vulnerability in Mattermost Server
When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients.
network
low complexity
mattermost
4.3
2023-04-20 CVE-2023-2193 Missing Authorization vulnerability in Mattermost
Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token.
network
low complexity
mattermost CWE-862
critical
9.1
2023-04-17 CVE-2023-1831 Cleartext Transmission of Sensitive Information vulnerability in Mattermost Server
Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).
network
low complexity
mattermost CWE-319
7.5
2023-03-22 CVE-2023-1562 Exposure of Resource to Wrong Sphere vulnerability in Mattermost
Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of a board owner.
network
low complexity
mattermost CWE-668
4.3
2023-03-15 CVE-2023-1421 Cross-site Scripting vulnerability in Mattermost Server
A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the victim via sharing a crafted link with a malicious state parameter.
network
low complexity
mattermost CWE-79
6.1
2023-02-27 CVE-2023-27263 Missing Authorization vulnerability in Mattermost
A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are not a member of.
network
low complexity
mattermost CWE-862
6.5
2023-02-27 CVE-2023-27264 Missing Authorization vulnerability in Mattermost
A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbookID] API.
network
low complexity
mattermost CWE-862
6.5