| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/mattermost/mattermost-server | ≥ 10.3.0+incompatible, < 10.3.4+incompatible≥ 10.4.0+incompatible, < 10.4.3+incompatible≥ 10.5.0+incompatible, < 10.5.1+incompatible≥ 9.11.0+incompatible, < 9.11.9+incompatible | 10.3.4+incompatible10.4.3+incompatible10.5.1+incompatible9.11.9+incompatible |
| github.com/mattermost/mattermost-server/v5 | all versions | |
| github.com/mattermost/mattermost-server/v6 | all versions | |
| github.com/mattermost/mattermost/server/v8 | ≥ 10.3.0, < 10.3.4≥ 10.4.0, < 10.4.3≥ 10.5.0, < 10.5.1≥ 9.11.0, < 9.11.9all versions | 10.3.410.4.310.5.19.11.9 |
| mattermost server | ≥ 10.3.0, < 10.3.4≥ 10.4.0, < 10.4.3≥ 9.11.0, < 9.11.9 | 10.3.410.4.39.11.9 |
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to bypass MFA protections via user search, channel search, or team search queries.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free