mattermost/mattermost · Security
Mattermost Server SAML implementation does not require encryption or signature verification as default
- GHSA ID
- GHSA-r6j5-fqx9-7qv9
- CVE ID
- CVE-2017-18909
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory.
CWEs
- CWE-311 · Missing Encryption of Sensitive Data
- CWE-347 · Improper Verification of Cryptographic Signature