Mattermost — безопасная платформа для совместной работы, позволяющая объединить ваши команды, инструменты и процессы для ускорения критически важной работы.
Релизный цикл, информация об уязвимостях
График релизов
Количество 300
CVE-2024-32939
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server."
CVE-2024-40886
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console.
CVE-2024-39836
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails.
CVE-2024-39810
Mattermost versions 9.5.x <= 9.5.7 and 9.10.x <= 9.10.0 fail to time limit and size limit the CA path file in the ElasticSearch configuration which allows a System Role with access to the Elasticsearch system console to add any file as a CA path field, such as /dev/zero and, after testing the connection, cause the application to crash.
CVE-2024-42411
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to restrict the input in POST /api/v4/users which allows a user to manipulate the creation date in POST /api/v4/users tricking the admin into believing their account is much older.
CVE-2024-43813
Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to enforce proper access controls which allows any authenticated user, including guests, to mark any channel inside any team as read for any user.
GHSA-hrf9-rm95-fpf3
Mattermost Cross-Site Request Forgery vulnerability
GHSA-4ww8-fprq-cq34
Mattermost doesn't redact remote users' original email addresses
GHSA-5263-pm2h-m7hw
Mattermost doesn't restrict which roles can promote a user as system admin
GHSA-c6vp-jjgv-38wj
Mattermost allows remote/synthetic users to create sessions, reset passwords
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2024-32939 Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server." | CVSS3: 3.7 | 0% Низкий | около 2 лет назад |
| CVE-2024-40886 Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console. | CVSS3: 8.8 | 0% Низкий | около 2 лет назад |
| CVE-2024-39836 Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails. | CVSS3: 6.5 | 0% Низкий | около 2 лет назад |
| CVE-2024-39810 Mattermost versions 9.5.x <= 9.5.7 and 9.10.x <= 9.10.0 fail to time limit and size limit the CA path file in the ElasticSearch configuration which allows a System Role with access to the Elasticsearch system console to add any file as a CA path field, such as /dev/zero and, after testing the connection, cause the application to crash. | CVSS3: 4.9 | 0% Низкий | около 2 лет назад |
| CVE-2024-42411 Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to restrict the input in POST /api/v4/users which allows a user to manipulate the creation date in POST /api/v4/users tricking the admin into believing their account is much older. | CVSS3: 5.3 | 0% Низкий | около 2 лет назад |
| CVE-2024-43813 Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to enforce proper access controls which allows any authenticated user, including guests, to mark any channel inside any team as read for any user. | CVSS3: 4.3 | 0% Низкий | около 2 лет назад |
| GHSA-hrf9-rm95-fpf3 Mattermost Cross-Site Request Forgery vulnerability | CVSS3: 4.6 | 0% Низкий | около 2 лет назад |
| GHSA-4ww8-fprq-cq34 Mattermost doesn't redact remote users' original email addresses | CVSS3: 4.3 | 0% Низкий | около 2 лет назад |
| GHSA-5263-pm2h-m7hw Mattermost doesn't restrict which roles can promote a user as system admin | CVSS3: 4.7 | 0% Низкий | около 2 лет назад |
| GHSA-c6vp-jjgv-38wj Mattermost allows remote/synthetic users to create sessions, reset passwords | CVSS3: 4.8 | 0% Низкий | около 2 лет назад |
Уязвимостей на страницу