CVE-2017-18894: High severity mattermost vulnerability
Published Jun 19, 2020
·Updated
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Sometimes. resource-owner authorization is bypassed, allowing account takeover.
Affected Software
6 affected components
Mattermost Mattermost Server<4.0.5
Mattermost Mattermost Server>=4.1.0<4.1.1
Mattermost Mattermost Server=4.2.0-rc1
Mattermost Mattermost Server=4.2.0-rc2
Mattermost Mattermost Server=4.2.0-rc3
Mattermost Mattermost Server=4.2.0-rc4
Event History
Jun 19, 2020
CVE Published
via MITRE·06:10 PM
Data Sourced
via MITRE·06:10 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-18894?
CVE-2017-18894 has a moderate severity rating due to the potential for account takeover through resource-owner authorization bypass.
2
How do I fix CVE-2017-18894?
To fix CVE-2017-18894, upgrade Mattermost Server to version 4.2.0 or later.
3
What versions of Mattermost Server are affected by CVE-2017-18894?
CVE-2017-18894 affects Mattermost Server versions prior to 4.2.0, including 4.0.5 and 4.1.0 to 4.1.1.
4
What type of vulnerability is CVE-2017-18894?
CVE-2017-18894 is an OAuth 2.0 authorization bypass vulnerability.
5
Can CVE-2017-18894 lead to data breaches?
Yes, CVE-2017-18894 can lead to account takeover, potentially allowing unauthorized access to user data.