Mattermost Server vulnerabilities
46 known vulnerabilities in Mattermost Server from Mattermost. 46 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Mattermost: Allocation of Resources Without Limits or Throttling
Mattermost fails to enforce a limit for the size of the cache entry for OpenGraph data allowing an attacker to send a specially crafted request to the /api/v4/opengraph filling the cache and turning the server unavailable.
- 8.2 High severity
Mattermost: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts.
- 8.8 High severity
Mattermost: Incorrect Authorization
Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin
- 7.5 High severity
Mattermost: Cleartext Transmission of Sensitive Information
Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).
- 8.8 High severity
Mattermost: Missing Authorization
Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might
- 7.5 High severity
Mattermost: Out-of-bounds Write
A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted POST body.