Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
171 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/mattermost/mattermost-server < 3.9.2; >= 3.10.0-rc1, < 3.10.2
Fixed in
3.10.23.9.2· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. CSRF can occur if CORS is enabled.
Recommended action: Upgrade to 3.10.2 or 3.9.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows SQL injection during the fetching of multiple posts.
Recommended action: Upgrade to 4.3.0, 4.2.1 or 4.1.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows Phishing because an error page can have a link.
Recommended action: Upgrade to 4.2.0, 4.1.1 or 4.0.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. Display names allow XSS.
Recommended action: Upgrade to 4.2.0, 4.1.1 or 4.0.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to add DEBUG lines to the logs via a REST API version 3 logging endpoint.
Recommended action: Upgrade to 4.2.0, 4.1.1 or 4.0.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Resource-owner authorization can be intermittently bypassed, allowing account takeover.
Recommended action: Upgrade to 4.2.0, 4.1.1 or 4.0.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows an attacker to create a button that, when pressed by a user, launches an API request.
Recommended action: Upgrade to 4.3.0, 4.2.1 or 4.1.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts that potentially cause a web browser to hang.
Recommended action: Upgrade to 4.2.0, 4.1.1 or 4.0.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information (user statuses) via a REST API version 4 endpoint.
Recommended action: Upgrade to 4.2.0, 4.1.1 or 4.0.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection.
Recommended action: Upgrade to 4.2.0, 4.1.1 or 4.0.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized.
Recommended action: Upgrade to 4.2.0, 4.1.1 or 4.0.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API.
Recommended action: Upgrade to 4.3.0, 4.2.1 or 4.1.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf.
Recommended action: Upgrade to 4.3.0, 4.2.1 or 4.1.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands.
Recommended action: Upgrade to 4.3.0, 4.2.1 or 4.1.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens.
Recommended action: Upgrade to 4.3.0, 4.2.1 or 4.1.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.
Recommended action: Upgrade to 4.3.0, 4.2.1 or 4.1.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
4.3.04.2.1-0.20171004194140-6d3cb2ce07fc4.1.2-0.20171004201910-6be8113eb60c· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file.
Recommended action: Upgrade to 4.3.0, 4.2.1-0.20171004194140-6d3cb2ce07fc (pre-release) or 4.1.2-0.20171004201910-6be8113eb60c (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
4.2.1-0.20171013140502-b3e4b0ac91684.1.2-0.20171013141717-ee57a5829ab14.3.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misformated post.
Recommended action: Upgrade to 4.3.0, 4.2.1-0.20171013140502-b3e4b0ac9168 (pre-release) or 4.1.2-0.20171013141717-ee57a5829ab1 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
4.2.1-0.20171004192657-8fbbd688ea244.3.04.1.2-0.20171004201910-6be8113eb60c· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.
Recommended action: Upgrade to 4.3.0, 4.2.1-0.20171004192657-8fbbd688ea24 (pre-release) or 4.1.2-0.20171004201910-6be8113eb60c (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.
Recommended action: Upgrade to 4.3.0, 4.2.1 or 4.1.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the authorlink field of a Slack attachment.
Recommended action: Upgrade to 4.3.0, 4.2.1 or 4.1.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
4.3.04.2.1-0.20171004194140-6d3cb2ce07fc4.1.2-0.20171004201910-6be8113eb60c· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.
Recommended action: Upgrade to 4.3.0, 4.2.1-0.20171004194140-6d3cb2ce07fc (pre-release) or 4.1.2-0.20171004201910-6be8113eb60c (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members.
Recommended action: Upgrade to 4.3.0, 4.2.1 or 4.1.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 2.1.0
Fixed in
2.1.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.
Recommended action: Upgrade to 2.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 2.2.0
Fixed in
2.2.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser.
Recommended action: Upgrade to 2.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.