vulnwire
7.5high

CVE-2017-18917

Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations

Also known as GHSA-jxc4-w54c-qv5r, GO-2026-4463

Published 6 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 54%
Public exploits
0
none known

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.

Exploit prediction (EPSS)

0.72% probability of exploitation in the next 30 days, higher than 54% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
gogithub.com/mattermost/mattermost-server
<3.7.5-0.20170421192444-247cd1e51a8c
>=3.8.0, <3.8.2
>=3.8.0+incompatible, <3.8.2+incompatible
3.7.5-0.20170421192444-247cd1e51a8c
3.8.2
3.8.2+incompatible

Classification

Weakness
  • CWE-916 Use of Password Hash With Insufficient Computational Effort
  • CWE-328 Use of Weak Hash

References

  • mattermost.com /security-updates/ · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-18917 · advisory
  • github.com /mattermost/mattermost/commit/247cd1e51a8c943628dc650e87e794b06aad4c2b · web
  • github.com /mattermost/mattermost/commit/b74e85653660525d351d090a1e1874ae933bcbc8 · web
  • github.com /mattermost/mattermost · package
  • mattermost.com /security-updates · web
  • github.com /advisories/GHSA-jxc4-w54c-qv5r · advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.