An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.

Published at: June 19, 2020 at 04:15PM
View on website

An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.

Published at: June 19, 2020 at 04:15PM
View on website

An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.

Published at: June 19, 2020 at 02:15PM
View on website

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misformatted post.

Published at: June 19, 2020 at 02:15PM
View on website

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal.

Published at: June 19, 2020 at 03:15PM
View on website