medium5.3
CVE-2017-18905
Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider
Impact
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost-server | < 3.9.2 | 3.9.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mattermost | Mattermost Server | before 3.9.2 from 3.10.0 before 3.10.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://mattermost.com/security-updates/
- https://github.com/advisories/GHSA-g24c-fx4v-xg9w
- https://nvd.nist.gov/vuln/detail/CVE-2017-18905
- https://github.com/mattermost/mattermost/commit/15ad24d160cb4604d0605ebbfa53d11a57820706
- https://github.com/mattermost/mattermost/commit/b17fca0d5ee7557e3df1cf1d1da8bd749859e35f
- https://github.com/mattermost/mattermost/commit/fbc170733e86f09b46ba754dd03304733d2f482f
- https://mattermost.com/security-updates