Vulnerabilities > Mattermost

DATE CVE VULNERABILITY TITLE RISK
2024-10-28 CVE-2024-10214 Unspecified vulnerability in Mattermost
Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings.
network
low complexity
mattermost
3.5
2024-09-26 CVE-2024-42406 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels.
network
low complexity
mattermost
5.4
2024-09-26 CVE-2024-45843 Server-Side Request Forgery (SSRF) vulnerability in Mattermost Server
Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.
network
low complexity
mattermost CWE-918
5.4
2024-09-26 CVE-2024-47003 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.
network
low complexity
mattermost
6.5
2024-09-26 CVE-2024-47145 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links.
network
low complexity
mattermost
4.3
2024-09-16 CVE-2024-39772 Unspecified vulnerability in Mattermost Desktop
Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots via JavaScript APIs.
network
low complexity
mattermost
5.3
2024-09-16 CVE-2024-45835 Unspecified vulnerability in Mattermost Desktop
Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfigurations via remote/local access.
network
low complexity
mattermost
6.5
2024-09-16 CVE-2024-39613 Uncontrolled Search Path Element vulnerability in Mattermost Desktop
Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cmd.exe file in the Downloads folder of a user's machine to cause remote code execution on that machine.
local
low complexity
mattermost CWE-427
7.8
2024-09-16 CVE-2024-45833 Unspecified vulnerability in Mattermost Mobile 1.26.0/1.29.0/1.30.0
Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password and visible password is selected, which allows the password to get saved in the dictionary when the user has Swiftkey as the default keyboard, the masking is off and the password contains a special character..
network
low complexity
mattermost
6.5
2024-08-22 CVE-2024-40884 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL.
network
low complexity
mattermost
2.7