Mattermost: >> Mattermost Server >> 8.1.5 Security Vulnerabilities
Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker to use a path traversal payload that points to a different endpoint leading to a CSRF attack.
CVSS Score
7.3
EPSS Score
0.003
Published
2023-12-12
Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and crash the Playbooks plugin
CVSS Score
4.3
EPSS Score
0.001
Published
2023-12-12
Page 6