vulnwire
5.3med

CVE-2017-18896

Mattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint

Also known as GHSA-63wg-qmrv-7q66, GO-2026-4299

Published 6 y ago · modified 4 mo ago · JSON

CVSS
5.3
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.8%
percentile 56%
Public exploits
0
none known

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to add DEBUG lines to the logs via a REST API version 3 logging endpoint.

Exploit prediction (EPSS)

0.78% probability of exploitation in the next 30 days, higher than 56% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.15.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:P/A:N
GitHub3.15.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected packages

EcosystemPackageAffectedFixed in
gogithub.com/mattermost/mattermost-server
>=4.1.0, <4.1.1
<4.0.5
>=4.2.0-rc1, <4.2.0
<4.0.5+incompatible
>=4.1.0+incompatible, <4.1.1+incompatible
>=4.2.0-rc1+incompatible, <4.2.0+incompatible
4.1.1
4.0.5
4.2.0
4.0.5+incompatible
4.1.1+incompatible
4.2.0+incompatible

Classification

Weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource

References

  • mattermost.com /security-updates/ · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-18896 · advisory
  • github.com /mattermost/mattermost/commit/3c34e2b2dcb0fde96a10e68d877aa7d0ab511669 · web
  • github.com /mattermost/mattermost/commit/722fb1947a2e7395ccf16adce9206736d803a9f3 · web
  • github.com /mattermost/mattermost/commit/d38328976e2c8bb0fab91e656042a0d8ac37bc76 · web
  • github.com /mattermost/mattermost · web
  • mattermost.com /security-updates · web
  • github.com /advisories/GHSA-63wg-qmrv-7q66 · advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.