CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-2787 – Collapsed Reply Threads APIs leak message contents from private channels
https://notcve.org/view.php?id=CVE-2023-2787
16 Jun 2023 — Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2023-2786 – Channel commands execution doesn't properly verify permissions
https://notcve.org/view.php?id=CVE-2023-2786
16 Jun 2023 — Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually post it by executing channel commands. Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually post it by executing channel commands. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-2808 – Lack of URL normalization allows rendering previews for disallowed domains
https://notcve.org/view.php?id=CVE-2023-2808
29 May 2023 — Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link preview on a disallowed domain using a specially crafted link. • https://mattermost.com/security-updates • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-2514 – DB username/password revealed in application logs
https://notcve.org/view.php?id=CVE-2023-2514
12 May 2023 — Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization. • https://mattermost.com/security-updates • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 9.4EPSS: 0%CPEs: 4EXPL: 0CVE-2023-2193 – Oauth authorization codes do not expire when deauthorizing an oauth2 app
https://notcve.org/view.php?id=CVE-2023-2193
20 Apr 2023 — Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-1562 – Full name revealed via /plugins/focalboard/api/v2/users
https://notcve.org/view.php?id=CVE-2023-1562
22 Mar 2023 — Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of a board owner. • https://mattermost.com/security-updates • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2023-27264 – IDOR: Updating a playbook via the Playbooks API
https://notcve.org/view.php?id=CVE-2023-27264
27 Feb 2023 — A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbookID] API. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-27263 – IDOR: Accessing playbook runs via the Playbooks Runs API
https://notcve.org/view.php?id=CVE-2023-27263
27 Feb 2023 — A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are not a member of. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4044 – Authenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost server
https://notcve.org/view.php?id=CVE-2022-4044
23 Nov 2022 — A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages. Una vulnerabilidad de Denegación de Servicio (DoS) en Mattermost permite que un usuario autenticado bloquee el servidor a través de múltiples mensajes de respuesta automática de gran tamaño. • https://hackerone.com/reports/1680241 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2022-2408 – Guest accounts can list all public channels
https://notcve.org/view.php?id=CVE-2022-2408
14 Jul 2022 — The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels. La función de cuenta de invitado en Mattermost versiones 6.7.0 y anteriores no restringe apropiadamente los permisos, lo que permite a un usuario invitado conseguir una lista de todos los canales públicos del equipo, a pesar de no formar parte de esos canales • https://mattermost.com/security-updates • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-863: Incorrect Authorization •