Vulnerabilities > Mattermost > Mattermost Server

DATE CVE VULNERABILITY TITLE RISK
2024-09-26 CVE-2024-42406 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels.
network
low complexity
mattermost
5.4
2024-09-26 CVE-2024-45843 Server-Side Request Forgery (SSRF) vulnerability in Mattermost Server
Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.
network
low complexity
mattermost CWE-918
5.4
2024-09-26 CVE-2024-47003 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.
network
low complexity
mattermost
6.5
2024-09-26 CVE-2024-47145 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links.
network
low complexity
mattermost
4.3
2024-08-22 CVE-2024-40884 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL.
network
low complexity
mattermost
2.7
2024-08-22 CVE-2024-42497 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams.
network
low complexity
mattermost
4.9
2024-08-22 CVE-2024-43780 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel.
network
low complexity
mattermost
4.3
2024-08-01 CVE-2024-39837 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, when shared channels were enabled.
network
low complexity
mattermost
5.4
2024-08-01 CVE-2024-39839 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow users to set their own remote username, when shared channels were enabled, which allows a user on a remote to set their remote username prop to an arbitrary string, which would be then synced to the local server as long as the user hadn't been synced before.
network
low complexity
mattermost
4.3
2024-08-01 CVE-2024-41144 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly validate synced posts, when shared channels are enabled,  which allows a malicious remote to create/update/delete arbitrary posts in arbitrary channels
network
low complexity
mattermost
7.1