CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-54682 – Zipbomb DoS via Missing Slack Import Validation
https://notcve.org/view.php?id=CVE-2024-54682
16 Dec 2024 — Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin. Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin. • https://mattermost.com/security-updates • CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-54083 – DoS via lack of type validation in Calls
https://notcve.org/view.php?id=CVE-2024-54083
16 Dec 2024 — Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to properly validate the type of callProps which allows a user to cause a client side (webapp and mobile) DoS to users of particular channels, by sending a specially crafted post. Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to properly validate the type of callProps which allows a user to cause a client side (webapp and mobile) DoS to users of particular channels,... • https://mattermost.com/security-updates • CWE-1287: Improper Validation of Specified Type of Input •
CVSS: 4.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-48872 – Bypass of "Max failed attempts" restriction via race condition
https://notcve.org/view.php?id=CVE-2024-48872
16 Dec 2024 — Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, and 9.5.x <= 9.5.12 fail to prevent concurrently checking and updating the failed login attempts. which allows an attacker to bypass of "Max failed attempts" restriction and send a big number of login attempts before being blocked via simultaneously sending multiple login requests Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, and 9.5.x <= 9.5.12 fail to prevent concurrently checking and updating the failed ... • https://mattermost.com/security-updates • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-11599 – Domain Restriction Bypass on Registration
https://notcve.org/view.php?id=CVE-2024-11599
28 Nov 2024 — Mattermost versions 10.0.x <= 10.0.1, 10.1.x <= 10.1.1, 9.11.x <= 9.11.3, 9.5.x <= 9.5.11 fail to properly validate email addresses which allows an unauthenticated user to bypass email domain restrictions via carefully crafted input on email registration. Las versiones de Mattermost 10.0.x <= 10.0.1, 10.1.x <= 10.1.1, 9.11.x <= 9.11.3, 9.5.x <= 9.5.11 no logran validar correctamente las direcciones de correo electrónico, lo que permite que un usuario no autenticado eluda las restricciones de dom... • https://mattermost.com/security-updates • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 3.1EPSS: 0%CPEs: 2EXPL: 0CVE-2024-36250 – MFA Code Replay
https://notcve.org/view.php?id=CVE-2024-36250
09 Nov 2024 — Mattermost versions 9.11.x <= 9.11.2, and 9.5.x <= 9.5.10 fail to protect the mfa code against replay attacks, which allows an attacker to reuse the MFA code within ~30 seconds Mattermost versions 9.11.x <= 9.11.2, and 9.5.x <= 9.5.10 fail to protect the mfa code against replay attacks, which allows an attacker to reuse the MFA code within ~30 seconds • https://mattermost.com/security-updates • CWE-303: Incorrect Implementation of Authentication Algorithm •
CVSS: 3.3EPSS: 0%CPEs: 4EXPL: 0CVE-2024-42000 – Unauthorized Access to view channels' details
https://notcve.org/view.php?id=CVE-2024-42000
09 Nov 2024 — Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels which allows a User or System Manager, with "Read Groups" permission but with no access for channels to retrieve details about private channels that they were not a member of by sending a request to /api/v4/channels. Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/... • https://mattermost.com/security-updates • CWE-863: Incorrect Authorization •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-46872 – Client-Side Path Traversal Leading to CSRF in Playbooks
https://notcve.org/view.php?id=CVE-2024-46872
29 Oct 2024 — Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks Las versiones 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 de Mattermost no pueden desinfectar las entradas del usuario en el frontend que se utilizan para la redirección, lo que permite un path traversal del lado del cliente con un solo clic que conduce a C... • https://mattermost.com/security-updates • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-47401 – DoS via Amplified GraphQL Response in Playbooks
https://notcve.org/view.php?id=CVE-2024-47401
29 Oct 2024 — Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn could cause the application to crash by sending a specially crafted request to Playbooks. Las versiones 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 y 9.5.x <= 9.5.9 de Mattermost no evitan que se muestren mensajes de error detallados en Playbooks, lo que p... • https://mattermost.com/security-updates • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-50052 – Arbitrary post deletion via Playbooks /ignore-thread endpoint
https://notcve.org/view.php?id=CVE-2024-50052
29 Oct 2024 — Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post. Las versiones de Mattermost 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 no verifican que el origen del mensaje en una acción de integración coincida con los metadatos de la publicación original, lo que permite que un usuario autenticado elimine una pu... • https://mattermost.com/security-updates • CWE-862: Missing Authorization •
CVSS: 4.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-10214 – Incorrect Session Creation with Desktop SSO
https://notcve.org/view.php?id=CVE-2024-10214
28 Oct 2024 — Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings. • https://mattermost.com/security-updates • CWE-303: Incorrect Implementation of Authentication Algorithm •