vulnwire
5.3med

CVE-2017-18916

Mattermost Server has Improper Authorization for Integration Requests

Also known as GHSA-x33g-375j-jhf7, GO-2026-4467

Published 6 y ago · modified 4 mo ago · JSON

CVSS
5.3
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.8%
percentile 56%
Public exploits
0
none known

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.

Exploit prediction (EPSS)

0.78% probability of exploitation in the next 30 days, higher than 56% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.15.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected packages

EcosystemPackageAffectedFixed in
gogithub.com/mattermost/mattermost-server
<3.6.7-0.20170420152529-0968e4079e0a
>=3.7.0, <3.7.5
>=3.8.0, <3.8.2
>=3.7.0+incompatible, <3.7.5+incompatible
>=3.8.0+incompatible, <3.8.2+incompatible
3.6.7-0.20170420152529-0968e4079e0a
3.7.5
3.8.2
3.7.5+incompatible
3.8.2+incompatible

Classification

Weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource
  • CWE-284 Improper Access Control

References

  • mattermost.com /security-updates/ · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-18916 · advisory
  • github.com /mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877 · web
  • github.com /mattermost/mattermost/commit/b74e85653660525d351d090a1e1874ae933bcbc8 · web
  • github.com /mattermost/mattermost/commit/fb325cc339eb8d8efb60dbadc48fd38897201c6f · web
  • github.com /mattermost/mattermost · package
  • mattermost.com /security-updates · web
  • github.com /advisories/GHSA-x33g-375j-jhf7 · advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.