github.com/mattermost/mattermost-server/v5

124 results · Clear filters · Feed

• Medium 4.7
  CVE-2022-1384

  Authorized users are allowed to install old plugin versions from the Marketplace

  Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might…

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Apr 19, 2022
• Medium 4.3
  CVE-2022-1332

  Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents

  One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents.

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Apr 13, 2022
• Medium 4.3
  CVE-2022-1337

  OOM DoS in Mattermost image proxy

  The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files.

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Apr 13, 2022
• Medium 5.3
  CVE-2020-14457

  Mattermost Server Sensitive Data Exposure

  An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the update_team WebSocket event, aka MMSA-2020-0012.

  github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v5 github.com/mattermost/mattermost Go
  Jun 19, 2020