CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2023-27264 – IDOR: Updating a playbook via the Playbooks API
https://notcve.org/view.php?id=CVE-2023-27264
27 Feb 2023 — A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbookID] API. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-27263 – IDOR: Accessing playbook runs via the Playbooks Runs API
https://notcve.org/view.php?id=CVE-2023-27263
27 Feb 2023 — A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are not a member of. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4044 – Authenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost server
https://notcve.org/view.php?id=CVE-2022-4044
23 Nov 2022 — A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages. Una vulnerabilidad de Denegación de Servicio (DoS) en Mattermost permite que un usuario autenticado bloquee el servidor a través de múltiples mensajes de respuesta automática de gran tamaño. • https://hackerone.com/reports/1680241 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2022-2408 – Guest accounts can list all public channels
https://notcve.org/view.php?id=CVE-2022-2408
14 Jul 2022 — The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels. La función de cuenta de invitado en Mattermost versiones 6.7.0 y anteriores no restringe apropiadamente los permisos, lo que permite a un usuario invitado conseguir una lista de todos los canales públicos del equipo, a pesar de no formar parte de esos canales • https://mattermost.com/security-updates • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-2406 – Malicious imports can lead to Denial of Service
https://notcve.org/view.php?id=CVE-2022-2406
14 Jul 2022 — The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API. La función de importación de Slack heredada en Mattermost versiones 6.7.0 y anteriores, no limita apropiadamente el tamaño de los archivos importados, lo que permite a un atacante autenticado bloquear el servidor importando archivos grandes por medio de la API REST de imp... • https://mattermost.com/security-updates • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-2401 – Team members could access sensitive information of other users via an API call
https://notcve.org/view.php?id=CVE-2022-2401
14 Jul 2022 — Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs. Una divulgación de información sin restricciones de todos los usuarios en Mattermost versiones 6.7.0 y anteriores, permite a miembros del equipo acceder a determinada información confidencial mediante el acceso directo a las API • https://mattermost.com/security-updates • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.6EPSS: 0%CPEs: 4EXPL: 0CVE-2022-2366 – Incorrect defaults can cause attackers to bypass rate limitations
https://notcve.org/view.php?id=CVE-2022-2366
11 Jul 2022 — Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers. Una configuración incorrecta por defecto del encabezado IP confiable en Mattermost versiones 6.7.0 y anteriores, permite a atacantes omitir algunas de las limitaciones de velocidad presentes o usar IPs manipuladas para el registro de auditoría por medio de la manipulación de... • https://mattermost.com/security-updates • CWE-276: Incorrect Default Permissions •