Mattermost — безопасная платформа для совместной работы, позволяющая объединить ваши команды, инструменты и процессы для ускорения критически важной работы.
Релизный цикл, информация об уязвимостях
График релизов
Количество 300
GHSA-v42f-hq78-8c5m
Denial of service in Mattermost
GHSA-hqqj-g6mv-rw46
A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the Playbooks API endpoints.
GHSA-3q29-6c6h-84hh
The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels.
GHSA-fv5r-cw7f-79jm
The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API.
CVE-2022-2406
The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API.
CVE-2022-2408
The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels.
CVE-2022-2408
The Guest account feature in Mattermost version 6.7.0 and earlier fail ...
CVE-2022-2406
The legacy Slack import feature in Mattermost version 6.7.0 and earlie ...
GHSA-6vjc-mjgp-qm8w
An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS. Unintended third-party servers could sometimes obtain authorization tokens, aka MMSA-2020-0022.
GHSA-hjj4-ch7m-p53m
An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to overwrite arbitrary files on a device.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
| GHSA-v42f-hq78-8c5m Denial of service in Mattermost | CVSS3: 6.5 | 1% Низкий | почти 4 года назад |
| GHSA-hqqj-g6mv-rw46 A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the Playbooks API endpoints. | CVSS3: 6.5 | 1% Низкий | почти 4 года назад |
| GHSA-3q29-6c6h-84hh The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels. | CVSS3: 4.3 | 1% Низкий | больше 4 лет назад |
| GHSA-fv5r-cw7f-79jm The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API. | CVSS3: 6.5 | 1% Низкий | больше 4 лет назад |
 | CVE-2022-2406 The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API. | CVSS3: 6.5 | 1% Низкий | больше 4 лет назад |
| CVE-2022-2408 The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels. | CVSS3: 4.3 | 1% Низкий | больше 4 лет назад |
| CVE-2022-2408 The Guest account feature in Mattermost version 6.7.0 and earlier fail ... | CVSS3: 4.3 | 1% Низкий | больше 4 лет назад |
| CVE-2022-2406 The legacy Slack import feature in Mattermost version 6.7.0 and earlie ... | CVSS3: 6.5 | 1% Низкий | больше 4 лет назад |
| GHSA-6vjc-mjgp-qm8w An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS. Unintended third-party servers could sometimes obtain authorization tokens, aka MMSA-2020-0022. | 1% Низкий | больше 4 лет назад | |
| GHSA-hjj4-ch7m-p53m An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to overwrite arbitrary files on a device. | 1% Низкий | больше 4 лет назад |
Уязвимостей на страницу