Read the docs

Mattermost

Records671All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical26CVSS 9.0–10.0
CVSS high130CVSS 7.0–8.9

Exploited now

Mattermost records in CISA KEV

No Mattermost vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Mattermost Server 506 records MEDIUM Mattermost 77 records MEDIUM Mattermost Desktop 34 records MEDIUM Mattermost Mobile 21 records LOW Confluence 14 records LOW Focalboard 2 records LOW Legal Hold 2 records LOW Mattermost Boards 2 records LOW

Records

2 records in Mattermost Boards · all components

TI-2021-15667 CVE-2021-37866 · GHSA-g28x-633f-r8qf

Session is not invalidated on server-side when user logged out of Boards

Priority LOW 34

Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00723 Published 2022-01-18 Fixed in 0.9.5, 0.8.4 +1 CWE-613
TI-2021-15668 CVE-2021-37867 · GHSA-gwpj-7fq2-hfw2

Emails of all users are exposed via one of the Boards APIs

Priority LOW 21

Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive &…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00672 Published 2022-01-18 Fixed in 0.9.5, 0.8.4 +1 CWE-200
Open these records in search →