Vulnerabilities > Mattermost

DATE CVE VULNERABILITY TITLE RISK
2023-12-12 CVE-2023-49874 Unspecified vulnerability in Mattermost Server
Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know the run ID.
network
low complexity
mattermost
4.3
2023-12-12 CVE-2023-6547 Unspecified vulnerability in Mattermost Server
Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to the team the playbook is on to access and modify the playbook.
network
low complexity
mattermost
5.4
2023-12-06 CVE-2023-6458 Injection vulnerability in Mattermost Server
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal.
network
low complexity
mattermost CWE-74
critical
9.8
2023-12-06 CVE-2023-6459 Unspecified vulnerability in Mattermost Server
Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response.
network
low complexity
mattermost
5.3
2023-11-27 CVE-2023-35075 Injection vulnerability in Mattermost
Mattermost fails to use  innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML.
network
low complexity
mattermost CWE-74
5.4
2023-11-27 CVE-2023-40703 Resource Exhaustion vulnerability in Mattermost
Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume excessive resources, possibly leading to Denial of Service, by patching the field of a block using a specially crafted string. 
network
low complexity
mattermost CWE-400
7.5
2023-11-27 CVE-2023-43754 Unspecified vulnerability in Mattermost
Mattermost fails to check whether the  “Allow users to view archived channels”  setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled. 
network
low complexity
mattermost
4.3
2023-11-27 CVE-2023-45223 Unspecified vulnerability in Mattermost
Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another user even if the Show Full Name option was disabled. 
network
low complexity
mattermost
4.3
2023-11-27 CVE-2023-47168 Open Redirect vulnerability in Mattermost
Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providing a invalid custom url scheme in /oauth/{service}/mobile_login?redirect_to=
network
low complexity
mattermost CWE-601
6.1
2023-11-27 CVE-2023-48268 Resource Exhaustion vulnerability in Mattermost
Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip (zip bomb).
network
low complexity
mattermost CWE-400
7.5