CVSS: 4.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-10214 – Incorrect Session Creation with Desktop SSO
https://notcve.org/view.php?id=CVE-2024-10214
28 Oct 2024 — Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings. • https://mattermost.com/security-updates • CWE-303: Incorrect Implementation of Authentication Algorithm •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-9155 – Insufficient Authorization On Unlinked Channel Files
https://notcve.org/view.php?id=CVE-2024-9155
26 Sep 2024 — Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an attacker to view them in channels that they are a member of. • https://mattermost.com/security-updates • CWE-863: Incorrect Authorization •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-47003 – DoS via non-string message using permalink embed
https://notcve.org/view.php?id=CVE-2024-47003
26 Sep 2024 — Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend. Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend. • https://mattermost.com/security-updates • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-42406 – Unauthorized access on archived channels
https://notcve.org/view.php?id=CVE-2024-42406
26 Sep 2024 — Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files. Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to r... • https://mattermost.com/security-updates • CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2024-43780 – Unauthorized channel file upload
https://notcve.org/view.php?id=CVE-2024-43780
22 Aug 2024 — Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2024-42497 – Insufficient permissions checks on teams
https://notcve.org/view.php?id=CVE-2024-42497
22 Aug 2024 — Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •
CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-40884 – Unauthorized disabling of invite URL
https://notcve.org/view.php?id=CVE-2024-40884
22 Aug 2024 — Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL. • https://mattermost.com/security-updates • CWE-284: Improper Access Control •
CVSS: 8.3EPSS: 0%CPEs: 4EXPL: 0CVE-2024-8071 – System Role with edit access to permissions can elevate themselves to system admin
https://notcve.org/view.php?id=CVE-2024-8071
22 Aug 2024 — Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which allows a System Role with edit access to the permissions section of system console to update their role (e.g. member) to include the `manage_system` permission, effectively becoming a System Admin. Las versiones de Mattermost 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 y 9.8.x <= 9.8.2 no restringen qué roles pueden promover a un usuar... • https://mattermost.com/security-updates • CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2024-42411 – User creation date manipulation in POST /api/v4/users
https://notcve.org/view.php?id=CVE-2024-42411
22 Aug 2024 — Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to restrict the input in POST /api/v4/users which allows a user to manipulate the creation date in POST /api/v4/users tricking the admin into believing their account is much older. Las versiones de Mattermost 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 no pueden restringir la entrada en POST /api/v4/users lo que permite a un usuario manipular la fecha de creación en POST /api/v4/users e... • https://mattermost.com/security-updates • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2024-40886 – One-click Client-Side Path Traversal Leading to CSRF in User Management admin page
https://notcve.org/view.php?id=CVE-2024-40886
22 Aug 2024 — Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console. Las versiones de Mattermost 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 no desinfectan las entradas del usuario en la interfaz que se utilizan para la redirección lo que permite path traversal... • https://mattermost.com/security-updates • CWE-352: Cross-Site Request Forgery (CSRF) •