An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel.
The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mattermost_server | Mattermost | * | 5.9.7 (excluding) |
| Mattermost_server | Mattermost | 5.15.0 (including) | 5.15.4 (excluding) |
| Mattermost_server | Mattermost | 5.16.0 (including) | 5.16.4 (excluding) |
| Mattermost_server | Mattermost | 5.17.0 (including) | 5.17.2 (excluding) |
| Mattermost_server | Mattermost | 5.18.0-rc1 (including) | 5.18.0-rc1 (including) |
| Mattermost_server | Mattermost | 5.18.0-rc2 (including) | 5.18.0-rc2 (including) |
| Mattermost_server | Mattermost | 5.18.0-rc3 (including) | 5.18.0-rc3 (including) |
| Mattermost_server | Mattermost | 5.18.0-rc4 (including) | 5.18.0-rc4 (including) |