Mattermost Mattermost Server

An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.

An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment.

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized.

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. Display names allow XSS.

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an uploaded file.

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the title_link field of a Slack attachment.

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a goto_location response to a slash command.

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS can occur via OpenGraph data.

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page.

An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.

Reflected XSS in OAuth flow completion endpoints

An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.

Reflected XSS in Mattermost Jira plugin

Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.

Account Takeover via Substring Matching in OpenID Connect Authentication

Open redirect in OAuth login

Open redirect in error page when link opened in new tab

Insufficient permissions checks on teams

Webhook Secret Exposure via Timing attack in MSteams plugin

Playbook run link to private channel grants channel access

Invitation Email is resent as a Reminder after invalidating pending email invites

Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token.

Repeated LDAP login failures can lock an LDAP account

Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post.

User profile update exposes password hash and MFA secrets

Post actions can run playbook checklist task commands

Denial of Service via Unbounded Memory Allocation in Integration Actions

Incorrect defaults can cause attackers to bypass rate limitations

An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service (application hang) via a crafted SVG document.

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deactivate themselves, bypassing a policy.

SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services.

Mattermost ABAC parent policy bypass via policy update endpoint

Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator

mmctl export download command doesn’t restrict permissions to created file to file owner

An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.

Unauthorized email invite to a private channel