CVE-2017-18886

Description

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands.

CVSS Metrics

• v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• v2.0•MEDIUM•Score: 6.5AV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 0.24%• Percentile: 48%

Techniques & Countermeasures

• CWE-732•Incorrect Permission Assignment for Critical Resource

  The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Affected Systems

• github.com/mattermost•mattermost-server

  < 4.1.2 | ≥ 4.2.0-rc1, < 4.2.1 | ≥ 4.3.0-rc1, < 4.3.0 | ≥ 4.3.0-rc1+incompatible, < 4.3.0+incompatible

• mattermost•mattermost_server

  < 4.1.2 | ≥ 4.2.0, < 4.2.1 | 4.3.0:rc1 | 4.3.0:rc2 | 4.3.0:rc3 | 4.3.0:rc4

References (5)

• https://mattermost.com/security-updates/
• https://nvd.nist.gov/vuln/detail/CVE-2017-18886
• https://github.com/mattermost/mattermost
• https://mattermost.com/security-updates
• https://github.com/advisories/GHSA-wvjg-33p9-938h