Mattermost Mattermost Mobile

An issue was discovered in Mattermost Mobile Apps before 1.26.0. Local logging is not blocked for sensitive information (e.g., server addresses or message content).

An issue was discovered in Mattermost Mobile Apps before 1.29.0. The iOS app allowed Single Sign-On cookies and Local Storage to remain after a logout, aka MMSA-2020-0013.

An issue was discovered in Mattermost Mobile Apps before 1.30.0. Authorization tokens can sometimes be disclosed to third-party servers, aka MMSA-2020-0018.

An issue was discovered in Mattermost Mobile Apps before 1.26.0. The Quick Reply feature mishandles crafted replies.

Mobile crash via object that can't be cast to String in Attachment Field

Mobile crash via improper validation of proto style in attachments

Unauthorized Notification Exposure in Mobile App Under Specific Conditions

Insufficient Input Validation on Post Props

Insufficient Input Validation on Post Props

Mattermost Mobile app versions 2.13.0 and earlier use a regular expression with polynomial complexity to parse certain deeplinks, which allows an unauthenticated remote attacker to freeze or crash the app via a long maliciously crafted link.

Denial of Service for mobile app users due to automatic code highlighting

Denial of Service Via Malicious GIF

Mobile password gets saved in dictionary under conditions

Spoofed push notifications from malicious server

Inadequate validation of SSO redirect credentials permits credential theft

Mobile SSO authentication flow allows credential theft via malicious server

Insecure Android File Provider Paths

An issue was discovered in Mattermost Mobile Apps before 1.26.0. A view cache can persist on a device after a logout.

An issue was discovered in Mattermost Mobile Apps before 1.26.0. Cookie data can persist on a device after a logout.

LaTeX post content manipulation via renderer state leak across contexts

Mobile crash via file with specially crafted filename