github.com/mattermost/mattermost/server/v8 vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2024-47003Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events CVE-2024-43780Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows guest user with read access to upload files to a channel CVE-2024-42497Highgithub.com/mattermost/mattermost/server/v8: Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams CVE-2024-40884Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows team admin user without "Add Team Members" permission to disable invite URL CVE-2024-39836Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows remote/synthetic users to create sessions, reset passwords CVE-2024-32939Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't redact remote users' original email addresses CVE-2024-40886Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost Cross-Site Request Forgery vulnerability CVE-2024-8071Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost doesn't restrict which roles can promote a user as system admin CVE-2024-41926Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows remote actor to set arbitrary RemoteId values for synced users CVE-2024-41144Highgithub.com/mattermost/mattermost/server/v8: Mattermost allows remote actor to create/update/delete posts in arbitrary channels CVE-2024-39837Lowgithub.com/mattermost/mattermost/server/v8: Mattermost did not properly restrict channel creation CVE-2024-39839Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows a user on a remote to set their remote username prop to an arbitrary string CVE-2024-39832Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows a remote actor to permanently delete local data by abusing dangerous error handling CVE-2024-39777Criticalgithub.com/mattermost/mattermost/server/v8: Mattermost allows unsolicited invites to expose access to local channels CVE-2024-41162Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost allows a remote actor to make an arbitrary local channel read-only CVE-2024-39274Criticalgithub.com/mattermost/mattermost/server/v8: Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel CVE-2024-29977Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost failed to properly validate synced reactions CVE-2024-36492Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost failed to disallow the modification of local users when syncing users in shared channels CVE-2024-2447Highgithub.com/mattermost/mattermost/server/v8: Mattermost fails to authenticate the source of certain types of post actions CVE-2024-28949Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost Server doesn't limit the number of user preferences CVE-2024-29221Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost Server Improper Access Control CVE-2024-21848Lowgithub.com/mattermost/mattermost/server/v8: Mattermost Server Improper Access Control CVE-2024-28053Lowgithub.com/mattermost/mattermost/server/v8: Mattermost Server Resource Exhaustion CVE-2024-1949Lowgithub.com/mattermost/mattermost/server/v8: Mattermost race condition CVE-2024-1953Mediumgithub.com/mattermost/mattermost/server/v8: Mattermost fails to limit the number of role names

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo