mattermost/mattermost · Security
Mattermost Server has intermittent Authorization bypass for resource-owners
- GHSA ID
- GHSA-gg42-mwr6-p82c
- CVE ID
- CVE-2017-18894
- Severity
- high
- Published
- Updated
- CVSS
- 8.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- CVSS v3
- 8.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Description
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Resource-owner authorization can be intermittently bypassed, allowing account takeover.
CWEs
- CWE-639 · Authorization Bypass Through User-Controlled Key
- CWE-732 · Incorrect Permission Assignment for Critical Resource