Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
171 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/mattermost/mattermost-server < 0.0.0-20240209181221-674f549daf0e
Fixed in
0.0.0-20240209181221-674f549daf0e· Vendor fix available
Issue
Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server.
Recommended action: Upgrade to 0.0.0-20240209181221-674f549daf0e (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 5.3.2-0.20230825233148-f787fd63368a
Fixed in
5.3.2-0.20230825233148-f787fd63368a· Vendor fix available
Issue
Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.
Recommended action: Upgrade to 5.3.2-0.20230825233148-f787fd63368a (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When running in a High Availability configuration, Mattermost fails to sanitize some of the userupdated and postdeleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients. Issue Identifier: MMSA-2023-00138
Recommended action: Upgrade to 7.7.2 or 7.1.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file. Issue Identifier: MMSA-2023-00139
Recommended action: Upgrade to 7.8.1, 7.7.2 or 7.1.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
7.7.21.4.1-0.20230301145909-10be118d99a57.8.17.1.6· Vendor fix available
Issue
Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.
Recommended action: Upgrade to 7.8.1, 7.7.2, 7.1.6 or 1.4.1-0.20230301145909-10be118d99a5 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel. Issue Identifier: MMSA-2023-00137
Recommended action: Upgrade to 7.7.2 or 7.1.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which could fetch a large amount of data.
Recommended action: Upgrade to 7.3.1, 7.2.1 or 7.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages.
Recommended action: Upgrade to 7.3.1, 7.2.1 or 7.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on a post.
Recommended action: Upgrade to 6.6.1, 6.5.1, 6.4.3 or 6.3.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 5.1.0
Fixed in
5.1.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 5.1.0. It allows attackers to cause a denial of service via the invitepeople slash command.
Recommended action: Upgrade to 5.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server.
Recommended action: Upgrade to 3.8.2, 3.7.5 or 3.6.7-rc1 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.7.4-0.20170404171331-0b5c0794fdcb
Fixed in
3.7.4-0.20170404171331-0b5c0794fdcb· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.7.5. It allows an attacker to specify a full pathname of a log file.
Recommended action: Upgrade to 3.7.4-0.20170404171331-0b5c0794fdcb (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.6.7-0.20170420152529-0968e4079e0a3.7.53.8.2· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.
Recommended action: Upgrade to 3.8.2, 3.7.5 or 3.6.7-0.20170420152529-0968e4079e0a (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.7.5-0.20170421192444-247cd1e51a8c; >= 3.8.0, < 3.8.2
Fixed in
3.7.5-0.20170421192444-247cd1e51a8c3.8.2· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.8.2 and 3.7.5. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.
Recommended action: Upgrade to 3.8.2 or 3.7.5-0.20170421192444-247cd1e51a8c (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.6.5; >= 3.7.0, < 3.7.3
Fixed in
3.6.53.7.3· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.
Recommended action: Upgrade to 3.7.3 or 3.6.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.6.7-0.20170420152529-0968e4079e0a3.7.53.8.2· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.
Recommended action: Upgrade to 3.8.2, 3.7.5 or 3.6.7-0.20170420152529-0968e4079e0a (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.10.3; >= 4.0.0, < 4.0.3
Fixed in
4.0.33.10.3· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 4.0.4 and 3.10.3. It allows CSV injection via a compliance report.
Recommended action: Upgrade to 4.0.3 or 3.10.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.9.1-rc1; >= 3.10.0, < 3.10.1
Fixed in
3.9.1-rc13.10.1· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 4.0.0, 3.10.1, and 3.9.1. A password reset request was sometimes sent to an attacker-provided e-mail address.
Recommended action: Upgrade to 3.10.1 or 3.9.1-rc1 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.9.2-0.20170714134023-b17fca0d5ee7; >= 3.10.0, < 3.10.2
Fixed in
3.10.23.9.2-0.20170714134023-b17fca0d5ee7· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account.
Recommended action: Upgrade to 3.10.2 or 3.9.2-0.20170714134023-b17fca0d5ee7 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover team invite IDs via team API endpoints.
Recommended action: Upgrade to 4.1.0, 4.0.4 or 3.10.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.8.1-0.20170504181128-4f074fed0d65
Fixed in
3.8.1-0.20170504181128-4f074fed0d65· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory.
Recommended action: Upgrade to 3.8.1-0.20170504181128-4f074fed0d65 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.9.2; >= 3.10.0, < 3.10.2
Fixed in
3.10.23.9.2· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an uploaded file.
Recommended action: Upgrade to 3.10.2 or 3.9.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.9.2; >= 3.10.0, < 3.10.2
Fixed in
3.10.23.9.2· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.
Recommended action: Upgrade to 3.10.2 or 3.9.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.9.2-0.20170714014920-312269ad0bd1; >= 3.10.0, < 3.10.2
Fixed in
3.10.23.9.2-0.20170714014920-312269ad0bd1· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.
Recommended action: Upgrade to 3.10.2 or 3.9.2-0.20170714014920-312269ad0bd1 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.10.3; >= 4.0.0, < 4.0.4
Fixed in
3.10.34.0.4· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover a team invite ID by requesting a JSON document.
Recommended action: Upgrade to 4.0.4 or 3.10.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.