CVE-2017-18903

Aliases:GHSA-fcwg-45jh-5qhfGO-2026-4305
Advisory lineage Upstream: 0 Downstream: 1
Modified
Published: 19 Jun 2020, 18:44
Last modified:05 Aug 2024, 21:37

Vulnerability Summary

Overall Risk (default)
medium
35/100
CVSS Score
8.8 HIGH
v3.1 (nvd)
EPSS Score
0.17% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

19 Jun 2020, 18:44
Published
Vulnerability first disclosed
05 Aug 2024, 21:37
Last Modified
Vulnerability information updated

Description

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. CSRF can occur if CORS is enabled.

CVSS Metrics

  • v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • v2.0•MEDIUM•Score: 5.1AV:N/AC:H/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 0.17%• Percentile: 38%

Techniques & Countermeasures

  • CWE-352•Cross-Site Request Forgery (CSRF)

    The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Affected Systems

  • github.com/mattermost•mattermost-server

    < 3.9.2 | ≥ 3.10.0-rc1, < 3.10.2 | ≥ 3.10.0+incompatible, < 3.10.2+incompatible

  • mattermost•mattermost_server

    < 3.9.2 | ≥ 3.10.0, < 3.10.2

References (8)