MS
Product
Mattermost Server
501
CVEs
0
On KEV
9.9
Max CVSS
15
New 30D
Severity mix
Critical 17High 86Medium 356Low 41
Watch
Add Mattermost Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-9155 | 4.3 | Sep 26 | Insufficient Authorization On Unlinked Channel Files Affected: 9.5.0 before 9.5.9; 9.9.0 before 9.9.3; 9.10.0 before 9.10.2 |
| CVE-2024-47145 | 4.3 | Sep 26 | Unauthorized access on archived channels via file links Affected: 9.5.0 before 9.5.9 |
| CVE-2024-43780 | 4.3 | Aug 22 | Unauthorized channel file upload Affected: 9.5.0 before 9.5.8; 9.8.0 before 9.8.3; 9.9.0 before 9.9.2; 9.10.0 |
| CVE-2024-41926 | 4.3 | Aug 1 | Malicious remote can claim that a user was synced from another remote Affected: 9.5.0 before 9.5.7; 9.9.0 |
| CVE-2024-41162 | 4.3 | Aug 1 | Malicious remote can make an arbitrary local channel read-only Affected: 9.5.0 before 9.5.7; 9.7.0 before 9.7.6; 9.8.0 before 9.8.2; 9.9.0 |
| CVE-2024-39839 | 4.3 | Aug 1 | Remote username set to an arbitrary string by remote user Affected: 9.5.0 before 9.5.7; 9.7.0 before 9.7.6; 9.8.0 before 9.8.2; 9.9.0 |
| CVE-2024-29215 | 4.3 | May 26 | Slash commands run in channel without channel membership via playbook task commands Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.6.0 before 9.6.2; 9.7.0 before 9.7.2 |
| CVE-2024-36241 | 4.3 | May 26 | /playbook add slash command allows viewing arbitrary post contents Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.6.0 before 9.6.2 |
| CVE-2024-5270 | 4.3 | May 26 | SAML to email switch possible when email signin is disabled Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.6.0 before 9.6.2; 9.7.0 before 9.7.2 |
| CVE-2024-5272 | 4.3 | May 26 | Run Details leak to guest via webhook event "custom_playbooks_playbook_run_updated" Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.6.0 before 9.6.2 |
| CVE-2024-34152 | 4.3 | May 26 | Playbook Run Metadata leak to Guest Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.6.0 before 9.6.2 |
| CVE-2024-34029 | 4.3 | May 26 | AD/LDAP Group Members Leak Affected: 8.1.0 before 8.1.13; 9.5.0 before 9.5.4; 9.7.0 before 9.7.2 |
| CVE-2024-4182 | 4.3 | Apr 26 | Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an… Affected: 8.1.0 before 8.1.12; 9.4.0 before 9.4.5; 9.5.0 before 9.5.3; 9.6.0 before 9.6.1 |
| CVE-2024-32046 | 4.3 | Apr 26 | Detailed error discloses full file path with dev mode off Affected: 8.1.0 before 8.1.12; 9.4.0 before 9.4.5; 9.5.0 before 9.5.3; 9.6.0 before 9.6.1 |
| CVE-2024-2446 | 4.3 | Mar 15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per message, allowing an… Affected: 8.1.0 before 8.1.10; 9.2.0 before 9.2.6; 9.3.0 before 9.3.2; 9.4.0 before 9.4.3 |
| CVE-2024-1953 | 4.3 | Feb 29 | Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated… Affected: 8.1.0 before 8.1.9; 9.2.0 before 9.2.5; 9.4.0 before 9.4.2; 9.3.0 |
| CVE-2024-1952 | 4.3 | Feb 29 | Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated attacker who can control… Affected: 8.1.0 before 8.1.9 |
| CVE-2024-1942 | 4.3 | Feb 29 | Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an… Affected: 8.1.0 before 8.1.9; 9.2.0 before 9.2.5; 9.3.0 |
| CVE-2024-1888 | 4.3 | Feb 29 | Existing server guests invited to the team by members without "invite_guest" permission Affected: before 8.1.9; 9.2.0 before 9.2.5; 9.3.0 before 9.3.1; 9.4.0 before 9.4.2 |
| CVE-2024-1887 | 4.3 | Feb 29 | Public channel post content accessible without membership when compliance export is enabled Affected: before 8.1.9; 9.2.0 before 9.2.5; 9.3.0 before 9.3.1 |
| CVE-2024-23488 | 4.3 | Feb 29 | Files of archived channels accessible with the “Allow users to view archived channels” option disabled Affected: before 8.1.9; 9.0.0 before 9.4.2 |
| CVE-2024-1402 | 4.3 | Feb 9 | Denial of service in mattermost mobile apps and server via emoji reactions Affected: through 8.1.7; 9.0.0 through 9.1.4; 9.2.0 through 9.2.3 |
| CVE-2024-24776 | 4.3 | Feb 9 | Incorrect Authorization leads to Channel Member Count Leak Affected: through 8.1.7 |
| CVE-2023-47858 | 4.3 | Jan 2 | Details of archived public channels are leaked to members of another team Affected: before 8.1.7; 9.0.0 before 9.0.5; 9.1.0 before 9.1.4; 9.2.0 before 9.2.3 |
| CVE-2023-50333 | 4.3 | Jan 2 | Lack of restriction to manage group names for freshly demoted guests Affected: before 8.1.7 |
| CVE-2023-48732 | 4.3 | Jan 2 | Keywords that trigger mentions are leaked to other users Affected: before 8.1.7 |
| CVE-2023-6727 | 4.3 | Dec 12 | Leak Inaccessible Playbook Information via Channel Action IDOR Affected: through 8.1.5; 9.2.0 through 9.2.1 |
| CVE-2023-49874 | 4.3 | Dec 12 | IDOR when updating the tasks of a private playbook run Affected: through 7.8.14; 8.0.0 through 8.1.5; 9.0.0 through 9.0.3; 9.1.1 through 9.1.2; 9.2.0 through 9.2.1 |
| CVE-2023-3585 | 4.3 | Jul 17 | Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link Affected: before 7.8.7; 7.9.0 before 7.9.5; 7.10.0 before 7.10.3 |
| CVE-2023-3582 | 4.3 | Jul 17 | Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private channel they don't have… Affected: 7.8.0 before 7.8.7; 7.9.0 before 7.9.5; 7.10.0 before 7.10.3 |
| CVE-2023-3577 | 4.3 | Jul 17 | Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an attacker to perform a limited blind SSRF Affected: 7.8.0 before 7.8.7; 7.10.0 before 7.10.3 |
| CVE-2023-2281 | 4.3 | Apr 25 | When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients Affected: before 7.9.0 |
| CVE-2022-1332 | 4.3 | Apr 13 | One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to… Affected: 5.37.0 before 5.37.9; 6.2.0 before 6.2.5; 6.3.0 before 6.3.5; 6.4.0 before 6.4.2 |
| CVE-2016-11081 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 2.2.0 Affected: before 2.2.0 |
| CVE-2016-11080 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.0.0 Affected: before 3.0.0 |
| CVE-2016-11065 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.3.0 Affected: before 3.3.0 |
| CVE-2017-18910 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7 Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2017-18890 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2017-18889 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2017-18878 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 Affected: before 4.1.2; 4.2.0 before 4.2.1; 4.3.0; 4.3.0; 4.3.0; 4.3.0 |
| CVE-2018-21256 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.1 Affected: before 5.1.0 |
| CVE-2018-21252 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3 Affected: before 4.10.3; 5.0.0 before 5.0.3; 5.1.0 before 5.1.1; 5.2.0; 5.2.0; 5.2.0; +3 more |
| CVE-2017-18872 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3 Affected: before 4.3.3; 4.4.0 before 4.4.3 |
| CVE-2019-20890 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.7 Affected: before 5.7.0 |
| CVE-2019-20887 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.7.1, 5.6.4, 5.5.3, and 4.10.6 Affected: before 4.10.6; 5.5.0 before 5.5.3; 5.6.0 before 5.6.4; 5.7.0 before 5.7.1 |
| CVE-2019-20883 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only Affected: before 5.8.0 |
| CVE-2019-20879 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7 Affected: before 4.10.7; 5.6.0 before 5.6.5; 5.7.0 before 5.7.2; 5.8.0; 5.8.0; 5.8.0; +1 more |
| CVE-2019-20878 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8 Affected: before 4.10.8; 5.7.0 before 5.7.3; 5.8.0 before 5.8.1; 5.9.0; 5.9.0; 5.9.0; +1 more |
| CVE-2018-21261 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3 Affected: 4.6.0 before 4.6.3; 4.7.0 before 4.7.4; 4.8.0 before 4.8.1 |
| CVE-2018-21255 | 4.3 | Jun 19 | An issue was discovered in Mattermost Server before 5.1 Affected: before 5.1.0 |
The 500 most important CVEs for this product (exploited first, then by severity)