Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
171 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/mattermost/mattermost-server < 3.0.0
Fixed in
3.0.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details.
Recommended action: Upgrade to 3.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name.
Recommended action: Upgrade to 4.5.0, 4.4.5, 4.3.4 or 4.2.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.0.0
Fixed in
3.0.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.
Recommended action: Upgrade to 3.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.0.0
Fixed in
3.0.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account.
Recommended action: Upgrade to 3.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 2.2.0
Fixed in
2.2.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.
Recommended action: Upgrade to 2.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 4.3.3; >= 4.4.0-rc1, < 4.4.3
Fixed in
4.4.34.3.3· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.
Recommended action: Upgrade to 4.4.3 or 4.3.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 2.2.0
Fixed in
2.2.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.
Recommended action: Upgrade to 2.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
4.3.04.2.1-0.20171004194140-6d3cb2ce07fc4.1.2-0.20171004201910-6be8113eb60· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal.
Recommended action: Upgrade to 4.3.0, 4.2.1-0.20171004194140-6d3cb2ce07fc (pre-release) or 4.1.2-0.20171004201910-6be8113eb60 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.0.0
Fixed in
3.0.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.
Recommended action: Upgrade to 3.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.0.0
Fixed in
3.0.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.
Recommended action: Upgrade to 3.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.1.0
Fixed in
3.1.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.1.1
Fixed in
3.1.1· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.1.1. The initialload API disclosed unnecessary personal information.
Recommended action: Upgrade to 3.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.0.0
Fixed in
3.0.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.
Recommended action: Upgrade to 3.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.1.0
Fixed in
3.1.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.0.2
Fixed in
3.0.2· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.
Recommended action: Upgrade to 3.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.0.0
Fixed in
3.0.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.
Recommended action: Upgrade to 3.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 2.0.1-0.20160310160916-26ad6d2c7696
Fixed in
2.0.1-0.20160310160916-26ad6d2c7696· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.
Recommended action: Upgrade to 2.0.1-0.20160310160916-26ad6d2c7696 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.2.0
Fixed in
3.2.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.2.0
Fixed in
3.2.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.2.0
Fixed in
3.2.0· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-server < 3.5.1
Fixed in
3.5.1· Vendor fix available
Issue
An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.
Recommended action: Upgrade to 3.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.