CVE-2017-18908 Mattermost Server password reset email requests can be sent to attacker-provided email addresses
CriticalCVSS 9.8
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Mattermost github.com/mattermost/mattermost-server/v6(Go) | < 3.9.1-rc1 | 3.9.1-rc1 |
| Mattermost github.com/mattermost/mattermost-server/v6(Go) | >= 3.10.0, < 3.10.1 | 3.10.1 |
| Mattermost github.com/mattermost/mattermost-server/v6(Go) | < 3.9.1-rc1+incompatible | 3.9.1-rc1+incompatible |
| Mattermost github.com/mattermost/mattermost-server/v6(Go) | >= 3.10.0+incompatible, < 3.10.1+incompatible | 3.10.1+incompatible |
| mattermost server | < 3.9.2 | 3.9.2 |
| mattermost server | >= 3.10.0, < 3.10.2 | 3.10.2 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com product
- mattermost.com vendor-advisory
- github.com vendor-advisory