CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-2514 – DB username/password revealed in application logs
https://notcve.org/view.php?id=CVE-2023-2514
Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization. • https://mattermost.com/security-updates • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-1562 – Full name revealed via /plugins/focalboard/api/v2/users
https://notcve.org/view.php?id=CVE-2023-1562
Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of a board owner. • https://mattermost.com/security-updates • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2023-27264 – IDOR: Updating a playbook via the Playbooks API
https://notcve.org/view.php?id=CVE-2023-27264
A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbookID] API. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-27263 – IDOR: Accessing playbook runs via the Playbooks Runs API
https://notcve.org/view.php?id=CVE-2023-27263
A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are not a member of. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4044 – Authenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost server
https://notcve.org/view.php?id=CVE-2022-4044
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages. Una vulnerabilidad de Denegación de Servicio (DoS) en Mattermost permite que un usuario autenticado bloquee el servidor a través de múltiples mensajes de respuesta automática de gran tamaño. • https://hackerone.com/reports/1680241 https://mattermost.com/security-updates • CWE-770: Allocation of Resources Without Limits or Throttling •