Juho Nurminen

The issue arises when ElasticSearch is enabled, and Mattermost fails to properly filter channel data. This allows a user to obtain private channel names by using the cmd+K/ctrl+K shortcut.

The issue arises from the failure to protect against abuse of a globally shared MathJax state, allowing an attacker to alter the contents of a LaTeX post. This can be achieved by creating another post with specific macro definitions.

The issue arises from the use of `path.Base` to extract the expected HTTP-01 token value, which behaves differently on Windows due to the distinct path separator (`` vs `/`). This allows a user to provide a relative path, potentially leading to the extraction of an unintended path. The extracted path is then suffixed with `+http-01` and opened. The impact is limited, as it only allows reading arbitrary files on the system if they have the `+http-01` suffix.

The issue arises from inadequate input validation on post actions, allowing an attacker to execute a playbook checklist task command as another user. This can be achieved by creating and sharing a deceptive post action that unexpectedly runs a slash command in an arbitrary channel.

The issue is related to a failure in enforcing proper access controls, allowing users to view arbitrary post contents. This can be achieved via the `/playbook` add slash command.

The issue is related to a failure in enforcing proper access control, allowing a user to run a slash command in a channel they are not a member of. This can be achieved by linking a playbook run to that channel and running a slash command as a playbook task command.

The issue arises from the failure to handle JSON parsing errors in custom status values, allowing an authenticated attacker to crash other users' web clients via a malformed custom status.

The issue arises from the failure to fully validate role changes, allowing an attacker authenticated as a team admin to demote users to guest via crafted HTTP requests.

The issue allows an unauthenticated remote attacker to freeze or crash the app via a long maliciously crafted link, due to the use of a regular expression with polynomial complexity to parse certain deeplinks.

The issue is related to the failure of Mattermost to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action.

The Mattermost Jira plugin fails to escape user-controlled outputs when generating HTML pages, allowing an attacker to perform reflected cross-site scripting attacks against the users of the Mattermost server.

The issue arises from the failure to correctly verify account ownership when switching from email to SAML authentication, allowing an authenticated attacker to take over other user accounts via a crafted switch request under specific conditions.

The issue is related to how an http.Client handles HTTP redirects. When an HTTP redirect is made to a domain that is not a subdomain match or exact match of the initial domain, sensitive headers such as `Authorization` or `Cookie` are not forwarded. However, a maliciously crafted HTTP redirect could cause these sensitive headers to be unexpectedly forwarded. For example, a redirect from foo.com to www.foo.com will forward the `Authorization` header, but a redirect to bar.com will not.

The issue allows an authenticated attacker who can control the update of an ephemeral post to access individual posts' contents in channels they are not a member of. This is due to a failure to sanitize data associated with permalinks when a plugin updates an ephemeral post.

The issue arises from the failure to sanitize metadata on posts containing permalinks under specific conditions. This allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.

The issue is related to the ParseAddressList function, which incorrectly handles comments within display names. This can lead to different trust decisions being made by programs using different parsers, potentially allowing a remote attacker to perform spoofing attacks by providing specially crafted input data.

The issue is related to the failure to sanitize channel mention data in posts, allowing an attacker to inject markup in the web client. This can lead to a Cross-site Scripting vulnerability.

The issue arises from Mattermost's failure to properly sanitize the user object when updating the username. This results in the password hash being included in the response body.

The go.mod toolchain directive can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software. The issue is related to incorrect code generation management when loading the Go Toolchain. Exploitation of the issue may allow a remote attacker to elevate privileges and execute arbitrary code.

The issue is related to Mattermost failing to properly validate the origin of a websocket connection. This allows a Man-In-The-Middle (MITM) attacker on Mattermost to access the websocket APIs.