Vulnerabilities > Mattermost > Medium

DATE CVE VULNERABILITY TITLE RISK
2024-08-01 CVE-2024-29977 Unspecified vulnerability in Mattermost
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly validate synced reactions, when shared channels are enabled, which allows a malicious remote to create arbitrary reactions on arbitrary posts
network
low complexity
mattermost
4.3
2024-08-01 CVE-2024-36492 Unspecified vulnerability in Mattermost
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow the modification of local users when syncing users in shared channels.
network
low complexity
mattermost
6.4
2024-08-01 CVE-2024-39274 Unspecified vulnerability in Mattermost
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to properly validate that the channel that comes from the sync message is a shared channel, when shared channels are enabled, which allows a malicious remote to add users to arbitrary teams and channels
network
low complexity
mattermost
6.5
2024-08-01 CVE-2024-39837 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, when shared channels were enabled.
network
low complexity
mattermost
5.4
2024-08-01 CVE-2024-39839 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow users to set their own remote username, when shared channels were enabled, which allows a user on a remote to set their remote username prop to an arbitrary string, which would be then synced to the local server as long as the user hadn't been synced before.
network
low complexity
mattermost
4.3
2024-08-01 CVE-2024-41162 Unspecified vulnerability in Mattermost Server
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote, when shared channels are enabled, which allows a malicious remote to make an arbitrary local channel read-only.
network
low complexity
mattermost
4.3
2024-08-01 CVE-2024-41926 Origin Validation Error vulnerability in Mattermost Server
Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.
network
low complexity
mattermost CWE-346
4.3
2024-07-15 CVE-2024-32945 Missing Initialization of Resource vulnerability in Mattermost Mobile 1.26.0/1.29.0/1.30.0
Mattermost Mobile Apps versions <=2.16.0 fail to protect against abuse of a globally shared MathJax state which allows an attacker to change the contents of a LateX post, by creating another post with specific macro definitions.
network
low complexity
mattermost CWE-909
5.3
2024-07-15 CVE-2024-39767 Improper Authentication vulnerability in Mattermost Mobile 1.26.0/1.29.0/1.30.0
Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a malicious server to send push notifications with another server’s diagnostic ID or server URL and have them show up in mobile apps as that server’s push notifications.
network
low complexity
mattermost CWE-287
6.5
2024-07-03 CVE-2024-36257 Unspecified vulnerability in Mattermost
Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A requesting the server B to update the profile picture of a user is the remote that actually has the user as a local one . This allows a malicious remote A to change the profile images of users that belong to another remote server C that is connected to the server A.
network
low complexity
mattermost
5.3