Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Mattermost 7.8.0 Clear all filters
TI-2023-01669 CVE-2023-1776 · GHSA-63f2-6959-2pxj

Stored XSS via SVG attachment on Boards

Priority LOW 34

Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00447 Published 2023-03-31 Fixed in 7.8.0, 7.7.2 +2 CWE-79
TI-2023-01668 CVE-2023-1775 · GHSA-8jhh-3jf2-pfwr

Unsanitized events sent over Websocket to regular users in a High Availability environment

Priority LOW 30

When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00546 Published 2023-03-31 Fixed in 7.8.0, 7.7.2 +1 CWE-200
TI-2023-01667 CVE-2023-1774 · GHSA-9hj7-v56g-rhf6

Unauthorized email invite to a private channel

Priority LOW 24

When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00317 Published 2023-03-31 Fixed in 7.7.2, 7.8.0 +1 CWE-862