Page 7 of 187 results (0.008 seconds)

CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0

When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients. • https://mattermost.com/security-updates • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-668: Exposure of Resource to Wrong Sphere •

CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0

When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •

CVSS: 2.7EPSS: 0%CPEs: 1EXPL: 0

Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response. • https://mattermost.com/security-updates • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 2.7EPSS: 0%CPEs: 1EXPL: 0

Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response. • https://mattermost.com/security-updates • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-668: Exposure of Resource to Wrong Sphere •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1

Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service. Mattermost versión 7.1.x y anteriores, no procesan suficientemente un archivo GIF específicamente diseñado cuando es descargado mientras es redactada una publicación, lo que permite a usuarios autenticados causar el agotamiento de los recursos mientras es procesado el archivo, resultando en una Denegación de Servicio del lado del servidor. • https://hackerone.com/reports/1620170 https://mattermost.com/security-updates • CWE-400: Uncontrolled Resource Consumption CWE-434: Unrestricted Upload of File with Dangerous Type •