Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: Mattermost Component: Mattermost Boards Clear all filters
TI-2021-15668 CVE-2021-37867 · GHSA-gwpj-7fq2-hfw2

Emails of all users are exposed via one of the Boards APIs

Priority LOW 21

Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive &…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00672 Published 2022-01-18 Fixed in 0.9.5, 0.8.4 +1 CWE-200
TI-2021-15667 CVE-2021-37866 · GHSA-g28x-633f-r8qf

Session is not invalidated on server-side when user logged out of Boards

Priority LOW 34

Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00723 Published 2022-01-18 Fixed in 0.9.5, 0.8.4 +1 CWE-613