CVE-2017-18915 Mattermost Server server restarts may provide attackers with API access
CriticalCVSS 9.8
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Mattermost github.com/mattermost/mattermost-server/v6(Go) | < 3.6.7-0.20170420152529-0968e4079e0a | 3.6.7-0.20170420152529-0968e4079e0a |
| Mattermost github.com/mattermost/mattermost-server/v6(Go) | >= 3.7.0, < 3.7.5 | 3.7.5 |
| Mattermost github.com/mattermost/mattermost-server/v6(Go) | >= 3.8.0, < 3.8.2 | 3.8.2 |
| Mattermost github.com/mattermost/mattermost-server/v6(Go) | >= 3.7.0+incompatible, < 3.7.5+incompatible | 3.7.5+incompatible |
| Mattermost github.com/mattermost/mattermost-server/v6(Go) | >= 3.8.0+incompatible, < 3.8.2+incompatible | 3.8.2+incompatible |
| mattermost server | >= 3.6.0, < 3.6.7 | 3.6.7 |
| mattermost server | >= 3.7.0, < 3.7.5 | 3.7.5 |
| mattermost server | >= 3.8.0, < 3.8.2 | 3.8.2 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com product
- mattermost.com vendor-advisory
- github.com vendor-advisory