Mattermost — безопасная платформа для совместной работы, позволяющая объединить ваши команды, инструменты и процессы для ускорения критически важной работы.
Релизный цикл, информация об уязвимостях
График релизов
Количество 249
CVE-2022-4019
A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the Playbooks API endpoints.
GHSA-3q29-6c6h-84hh
The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels.
GHSA-fv5r-cw7f-79jm
The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API.
CVE-2022-2408
The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels.
CVE-2022-2408
The Guest account feature in Mattermost version 6.7.0 and earlier fail ...
CVE-2022-2406
The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API.
CVE-2022-2406
The legacy Slack import feature in Mattermost version 6.7.0 and earlie ...
GHSA-r4f6-w245-8wv4
Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.
GHSA-6vjc-mjgp-qm8w
An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS. Unintended third-party servers could sometimes obtain authorization tokens, aka MMSA-2020-0022.
GHSA-hjj4-ch7m-p53m
An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to overwrite arbitrary files on a device.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2022-4019 A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the Playbooks API endpoints. | CVSS3: 4.3 | 1% Низкий | около 3 лет назад |
| GHSA-3q29-6c6h-84hh The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels. | CVSS3: 4.3 | 0% Низкий | больше 3 лет назад |
| GHSA-fv5r-cw7f-79jm The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API. | CVSS3: 6.5 | 0% Низкий | больше 3 лет назад |
| CVE-2022-2408 The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels. | CVSS3: 4.3 | 0% Низкий | больше 3 лет назад |
| CVE-2022-2408 The Guest account feature in Mattermost version 6.7.0 and earlier fail ... | CVSS3: 4.3 | 0% Низкий | больше 3 лет назад |
| CVE-2022-2406 The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API. | CVSS3: 4.3 | 0% Низкий | больше 3 лет назад |
| CVE-2022-2406 The legacy Slack import feature in Mattermost version 6.7.0 and earlie ... | CVSS3: 4.3 | 0% Низкий | больше 3 лет назад |
| GHSA-r4f6-w245-8wv4 Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost. | 45% Средний | больше 3 лет назад | |
| GHSA-6vjc-mjgp-qm8w An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS. Unintended third-party servers could sometimes obtain authorization tokens, aka MMSA-2020-0022. | 0% Низкий | больше 3 лет назад | |
| GHSA-hjj4-ch7m-p53m An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to overwrite arbitrary files on a device. | 1% Низкий | больше 3 лет назад |
Уязвимостей на страницу