Mattermost Mattermost Server

An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user activation/deactivation.

Stack overflow in document extractor in Mattermost

OOM DoS in Mattermost image proxy

Team members could access sensitive information of other users via an API call

An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001.

An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.

Excessive resource consumption when sending long emoji names in user custom status

Todo plugin gets crashed and disabled by member

DoS via lack of type validation in Calls

DoS via custom post type for sysconsole plugin readers

Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table.

Server crash via a specially crafted markdown input

Denial of Service via multiple identical User IDs in /api/v4/users/ids

Insufficient Input Validation on Post Props

WebApp crash via improper validation of proto style in attachments

DoS via non-string message using permalink embed

DoS via a large number of User Preferences

Unsanitized events sent over Websocket to regular users in a High Availability environment

Information disclosure in linked message previews

Excessive resource consumption due to lack to request path size limits

Resource Exhaustion via the Invitation Feature

Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames

Insufficient Input Validation on Post Props

Zipbomb DoS via Missing Slack Import Validation

Inaccessible Post Information Leak via Run Timeline IDOR

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel.

Boards plugin panics on WebSocket command with non-string field types

Mattermost Server Denial of Service via Animated GIF Emoji Upload

Denial of service via resource exhaustion in Mattermost

Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost

Uploading a crafted image causes excessive memory allocation in the Mattermost Server

Unbounded zlib decompression in Calls SDP WebSocket messages

Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Unbounded memory consumption during PDF text extraction

Team associated AD/LDAP Groups Leaked due to missing authorization

Data Retention Teams Endpoint Leaks Private Team Invite ID

IDOR in CreatePost API allows for timeboxed message disclosure

Missing property field ownership validation in Playbooks run property update endpoint

Zip Bomb Denial of Service via Unrestricted Archive Decompression