Mattermost: >> Mattermost Server >> 7.9.1 Security Vulnerabilities
Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs.
CVSS Score
6.2
EPSS Score
0.001
Published
2023-07-17
Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private channel they don't have access to,
CVSS Score
4.3
EPSS Score
0.001
Published
2023-07-17
Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link.
CVSS Score
4.3
EPSS Score
0.001
Published
2023-07-17
Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boards to remain accessible.
CVSS Score
4.2
EPSS Score
0.002
Published
2023-07-17
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.
CVSS Score
4.8
EPSS Score
0.002
Published
2023-07-17
Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin
CVSS Score
4.7
EPSS Score
0.001
Published
2023-05-12
Page 3