Mattermost Server

A crafted SVG attachment can crash a Mattermost server

Team members could access sensitive information of other users via an API call

An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001.

An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.

Excessive resource consumption when sending long emoji names in user custom status

Todo plugin gets crashed and disabled by member

DoS via lack of type validation in Calls

DoS via custom post type for sysconsole plugin readers

Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table.

Server crash via a specially crafted markdown input

DoS via non-string message using permalink embed

DoS via a large number of User Preferences

Insufficient Input Validation on Post Props

WebApp crash via improper validation of proto style in attachments

Unsanitized events sent over Websocket to regular users in a High Availability environment

Excessive resource consumption due to lack to request path size limits

Information disclosure in linked message previews

Denial of Service via HTTP/2 single packet attack on login endpoint

Resource Exhaustion via the Invitation Feature

Denial of Service via multiple identical User IDs in /api/v4/users/ids

Zipbomb DoS via Missing Slack Import Validation

Mattermost Remote Cluster PATCH API Leaks Authentication Tokens

Inaccessible Post Information Leak via Run Timeline IDOR

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel.

Insufficient Input Validation on Post Props

SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service

Denial of service via resource exhaustion in Mattermost

Zip Bomb Denial of Service via Unrestricted Archive Decompression

Mattermost Server Denial of Service via Animated GIF Emoji Upload

Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost

Memory Exhaustion via Malicious 7zip File Upload

Denial of service via crafted TIFF file upload

Boards plugin panics on WebSocket command with non-string field types

Instance and webhook GitLab plugin commands were able to be run by non-admin users

Prevent password disclosure and force reset during Slack import

Team associated AD/LDAP Groups Leaked due to missing authorization

Server panic via outgoing webhook responses

DoS from quadratic complexity in model.ParseHashtags

Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels

Missing authorization check in AI message rewrite endpoint allows access to private thread content