CVE-2016-11075

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Jun 19, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-110765.3An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.CVE-2016-110772.7An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name anCVE-2016-110786.5An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fieldCVE-2016-110796.1An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.CVE-2016-11087.5Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer CVE-2016-110804.3An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details.CVE-2016-110814.3An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser.CVE-2016-110826.1An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.CVE-2016-110836.1An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.CVE-2016-110846.1An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.CVE-2016-110856.5php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the CVE-2016-110867.4lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot
CVE-2016-11075: Medium severity, CVSS 5.3 | Vulnix