Mattermost: >> Mattermost >> 1.23.1 Security Vulnerabilities
Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crash the Calls plugin
CVSS Score
4.3
EPSS Score
0.001
Published
2023-11-06
Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.
CVSS Score
4.9
EPSS Score
0.001
Published
2023-11-06
Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_location, to fill up the memory due to caching large items.
CVSS Score
5.3
EPSS Score
0.001
Published
2023-11-06
Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojis to a channel and freeze the mobile app of users when viewing that particular channel.
CVSS Score
4.3
EPSS Score
0.001
Published
2023-10-17
Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection.
CVSS Score
8.1
EPSS Score
0.002
Published
2023-07-17
Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization.
CVSS Score
6.7
EPSS Score
0.001
Published
2023-05-12
Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of a board owner.
CVSS Score
3.5
EPSS Score
0.002
Published
2023-03-22
A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are not a member of.
CVSS Score
4.3
EPSS Score
0.001
Published
2023-02-27
A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbookID] API.
CVSS Score
7.1
EPSS Score
0.0
Published
2023-02-27
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages.
CVSS Score
4.3
EPSS Score
0.006
Published
2022-11-23