Mattermost: Security Vulnerabilities
Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link.
CVSS Score
4.3
EPSS Score
0.005
Published
2023-07-17
Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boards to remain accessible.
CVSS Score
4.2
EPSS Score
0.003
Published
2023-07-17
Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join the board with editor access, without the UI showing the updated permissions.
CVSS Score
2.7
EPSS Score
0.004
Published
2023-07-17
Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments.
CVSS Score
3.1
EPSS Score
0.004
Published
2023-07-17
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.
CVSS Score
4.8
EPSS Score
0.003
Published
2023-07-17
Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation of large log files which can result in Denial of Service
CVSS Score
4.3
EPSS Score
0.006
Published
2023-06-16
Mattermost fails to sanitize ephemeral error messages, allowing an attacker to obtain arbitrary message contents by a specially crafted /groupmsg command.
CVSS Score
6.5
EPSS Score
0.006
Published
2023-06-16
Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by a linking to a specially crafted webpage in a message.
CVSS Score
6.5
EPSS Score
0.006
Published
2023-06-16
Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a channel.
CVSS Score
3.1
EPSS Score
0.005
Published
2023-06-16
Mattermost fails to unescape Markdown strings in a memory-efficient way, allowing an attacker to cause a Denial of Service by sending a message containing a large number of escaped characters.
CVSS Score
4.3
EPSS Score
0.007
Published
2023-06-16