| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/mattermost/mattermost-server | ≥ 9.3.0+incompatible, < 9.3.3+incompatible≥ 9.4.0+incompatible, < 9.4.4+incompatible≥ 9.5.0+incompatible, < 9.5.2+incompatible | 9.3.3+incompatible9.4.4+incompatible9.5.2+incompatible |
| github.com/mattermost/mattermost-server/v5 | all versions | |
| github.com/mattermost/mattermost-server/v6 | all versions | |
| github.com/mattermost/mattermost/server/v8 | ≥ 8.1.0, < 8.1.11≥ 9.3.0, < 9.3.3≥ 9.4.0, < 9.4.4≥ 9.5.0, < 9.5.2all versions | 8.1.119.3.39.4.49.5.2 |
| mattermost server | ≥ 8.1.0, < 8.1.11≥ 9.3.0, < 9.3.3≥ 9.4.0, < 9.4.4≥ 9.5.0, < 9.5.2 | 8.1.119.3.39.4.49.5.2 |
Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free