Mattermost Server vulnerabilities
486 vulnerabilities
Known vulnerabilities in Mattermost Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-21248mattermostmattermost_server
EPSS score1.23%
An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials.CVE-2018-21259mattermostmattermost_serverEPSS score1.10%
An issue was discovered in Mattermost Server before 4.10.1, 4.9.4, and 4.8.2. It allows attackers to cause a denial of service (application hang) via a malformed link in a channel.CVE-2018-21257mattermostmattermost_serverEPSS score0.81%
An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for setting a channel header) via the Channel header slash command API.CVE-2018-21256mattermostmattermost_serverEPSS score0.61%
An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for group-message channel creation) via the Group message slash command.CVE-2018-21258github.com/mattermostmattermost-server+2EPSS score1.17%
An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash command.CVE-2018-21249mattermostmattermost_serverEPSS score0.73%
An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing.CVE-2018-21250mattermostmattermost_serverEPSS score1.08%
An issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4. It allows remote attackers to cause a denial of service (memory consumption) via crafted image dimensions.CVE-2018-21261mattermostmattermost_serverEPSS score0.58%
An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. An e-mail invite accidentally included the team invite_id, which leads to unintended excessive invitation privileges.CVE-2018-21263mattermostmattermost_serverEPSS score0.93%
An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a different user's account via a crafted SAML response.CVE-2018-21253mattermostmattermost_serverEPSS score0.58%
An issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use the invite_people slash command to invite a non-permitted user.CVE-2018-21264mattermostmattermost_serverEPSS score1.12%
An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. It did not enforce the expiration date of a SAML response.CVE-2018-21252mattermostmattermost_serverEPSS score0.61%
An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers could use multiple e-mail addresses to bypass a domain-based policy for signups.CVE-2018-21251mattermostmattermost_serverEPSS score1.20%
An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body.CVE-2018-21262mattermostmattermost_serverEPSS score1.11%
An issue was discovered in Mattermost Server before 4.7.3. It allows attackers to cause a denial of service (application crash) via invalid LaTeX text.CVE-2018-21260mattermostmattermost_serverEPSS score0.74%
An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events were accidentally sent during certain user-management operations, violating user privacy.CVE-2018-21254mattermostmattermost_serverEPSS score0.61%
An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control (for direct-message channel creation) via the Message slash command.CVE-2018-21255mattermostmattermost_serverEPSS score0.58%
An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel.CVE-2021-37863mattermostmattermost+1EPSS score0.86%
Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post.CVE-2021-37862mattermostmattermost+1EPSS score0.69%
Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token.CVE-2015-9548mattermostmattermost_serverEPSS score1.09%
An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory consumption) via a small compressed file that has a large size when uncompressed.