medium6.9
CVE-2017-18916
Mattermost Server has Improper Authorization for Integration Requests
Impact
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost-server | < 3.6.7-0.20170420152529-0968e4079e0a | 3.6.7-0.20170420152529-0968e4079e0a |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mattermost | Mattermost Server | before 3.6.7 from 3.7.0 before 3.7.5 from 3.8.0 before 3.8.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://mattermost.com/security-updates/
- https://github.com/advisories/GHSA-x33g-375j-jhf7
- https://nvd.nist.gov/vuln/detail/CVE-2017-18916
- https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877
- https://github.com/mattermost/mattermost/commit/b74e85653660525d351d090a1e1874ae933bcbc8
- https://github.com/mattermost/mattermost/commit/fb325cc339eb8d8efb60dbadc48fd38897201c6f
- https://mattermost.com/security-updates