medium5.3
CVE-2017-18876
Mattermost Server is vulnerable to Path Traversal when files are stored locally
Impact
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost-server | < 4.1.2-0.20171004201910-6be8113eb60c | 4.1.2-0.20171004201910-6be8113eb60c |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mattermost | Mattermost Server | before 4.1.2 from 4.2.0 before 4.2.1 Version 4.3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://mattermost.com/security-updates/
- https://github.com/advisories/GHSA-hjqh-j6rj-gh8q
- https://nvd.nist.gov/vuln/detail/CVE-2017-18876
- https://github.com/mattermost/mattermost/commit/6be8113eb60cf5ddd2dc1c3f4db05cae0c183086
- https://github.com/mattermost/mattermost/commit/6d3cb2ce07fc799832081e93843b405b390057fa
- https://github.com/mattermost/mattermost/commit/fadd9514f6e71590aba781a7035e1de4150137b0
- https://mattermost.com/security-updates