← Back

Mattermost

mattermost

645 CVEs • 16 products

Products (16)

Click to collapse
Toggle
Mattermost Server
mattermost_server
486 CVEs
Mattermost
mattermost
78 CVEs
Mattermost Desktop
mattermost_desktop
34 CVEs
Mattermost Mobile
mattermost_mobile
21 CVEs
Confluence
confluence
14 CVEs
Mattermost Boards
mattermost_boards
2 CVEs
Playbooks
playbooks
2 CVEs
Ms Teams
ms_teams
2 CVEs
Zoom
zoom
2 CVEs
Focalboard
focalboard
2 CVEs
Legal Hold
legal_hold
2 CVEs
Mattermost Packages
mattermost_packages
1 CVE
Mattermost Plugins
mattermost_plugins
1 CVE
Mattermost Channel Export
mattermost_channel_export
1 CVE
Channel Export
channel_export
1 CVE
Google Drive
google_drive
1 CVE

CVEs (645)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-37864
1Mattermost
1Mattermost
Jun 17, 2026
Jan 18, 2022
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrat...Show more
Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs.Show less
CVE-2021-37863
1Mattermost
1Mattermost Server
Jun 17, 2026
Dec 17, 2021
N/A· v4
5.7 MEDIUM· v3
3.5 LOW· v2
Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post.
CVE-2021-37862
1Mattermost
1Mattermost Server
Jun 17, 2026
Dec 17, 2021
N/A· v4
5.4 MEDIUM· v3
5.8 MEDIUM· v2
Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation toke...Show more
Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token.Show less
CVE-2021-37861
1Mattermost
1Mattermost
Jun 17, 2026
Dec 9, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.
CVE-2021-37860
1Mattermost
1Mattermost
Jun 17, 2026
Sep 22, 2021
N/A· v4
6.1 MEDIUM· v3
2.6 LOW· v2
Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.
CVE-2021-37859
1Mattermost
1Mattermost
Jun 17, 2026
Aug 5, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.
CVE-2020-13891
1Mattermost
1Mattermost
Jun 17, 2026
Jun 26, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS. Unintended third-party servers could sometimes obtain authorization tokens, aka MMSA-2020-0022.
CVE-2017-18921
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.
CVE-2017-18920
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy.
CVE-2017-18919
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation.
CVE-2017-18918
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
4.9 MEDIUM· v3
4.0 MEDIUM· v2
An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.
CVE-2017-18917
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.
CVE-2017-18916
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.
CVE-2017-18915
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.
CVE-2017-18914
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist.
CVE-2017-18913
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page.
CVE-2017-18908
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address.
CVE-2017-18907
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.
CVE-2017-18906
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
8.1 HIGH· v3
4.9 MEDIUM· v2
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account.
CVE-2017-18905
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.