DeutschShown in its original language — a full translation is planned for a future version.
Mattermost Server und Desktop: Mehrere Schwachstellen
view advisory published 2025-12-17
Ein Angreifer kann mehrere Schwachstellen in Mattermost Server und Desktop ausnutzen, um Informationen offenzulegen, Sicherheitsmechanismen zu umgehen und um einen Denial of Service Zustand herbeizuführen.
01
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-14435US | medium6.5 | — | ||
Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows authenticated users to cause application-l… | ||||
| CVE-2025-14822US | medium6.5 | — | ||
Mattermost versions 10.11.x <= 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources via a single HTTP requ… | ||||
| CVE-2025-13326US | — | — | ||
Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC per… | ||||
| CVE-2025-13321US | — | — | ||
Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker with access to the use… | ||||
| CVE-2025-12689US | — | — | ||
Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attacker to crash Calls plu… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan