PT-2020-8901 · Mattermost · Mattermost Server

Published 2020-06-19 · Updated 2025-12-15 · CVE-2018-21258

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.1

Description An issue in Mattermost Server allows attackers to cause a denial of service via the invite people slash command.

Recommendations For versions prior to 5.1, update to version 5.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the invite people slash command until the update is applied.

Fix

DoS

Resource Exhaustion

Special Elements Injection

Weakness Enumeration

CWE-400

CWE-74

Related Identifiers

CVE-2018-21258

GHSA-5MH6-P63G-3MV5

GO-2025-4146

SUSE-SU-2025:4395-1

Affected Products

Mattermost Server

References · 49

• https://nvd.nist.gov/vuln/detail/CVE-2018-21258 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:4395-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-21258 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4146 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5mh6-p63g-3mv5 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/af615ffc24b774d76deef8c93282831432669dd8 · Note
• https://suse.com/security/cve/CVE-2025-60632 · Note
• https://suse.com/security/cve/CVE-2025-66410 · Note
• https://suse.com/security/cve/CVE-2025-61725 · Note
• https://suse.com/security/cve/CVE-2025-65026 · Note
• https://suse.com/support/update/announcement/2025/suse-su-20254395-1 · Note
• https://suse.com/security/cve/CVE-2017-18870 · Note
• https://suse.com/security/cve/CVE-2025-60638 · Note