Mattermost Server SAML implementation does not require encryption or signature verification as default

ALTO 7.5CVE-2017-18909 · GHSA-r6j5-fqx9-7qv9 · GO-2026-4478 · Published 19/06/2020 · updated 17/06/2026

In breve

CVE-2017-18909 è una vulnerabilità ALTO (CVSS 7.5) che riguarda github.com/mattermost/mattermost-server, mattermost server (mattermost).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.66%, superiore al 51.5% delle vulnerabilità.
Correzione: aggiornare a 3.8.1-0.20170504181128-4f074fed0d65, 3.9.0 o successiva.

Package	Affected versions	Patched versions
github.com/mattermost/mattermost-server Go	`< 3.8.1-0.20170504181128-4f074fed0d65all versions`	`3.8.1-0.20170504181128-4f074fed0d65`
mattermost server mattermost	`< 3.9.0`	`3.9.0`

An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory.

NVD description

An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

In breve

CVE-2017-18909 è una vulnerabilità ALTO (CVSS 7.5) che riguarda github.com/mattermost/mattermost-server, mattermost server (mattermost).

Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.66%, superiore al 51.5% delle vulnerabilità.

Correzione: aggiornare a 3.8.1-0.20170504181128-4f074fed0d65, 3.9.0 o successiva.

Package

Affected versions

Patched versions

< 3.8.1-0.20170504181128-4f074fed0d65all versions

3.8.1-0.20170504181128-4f074fed0d65

< 3.9.0

3.9.0

Altre vulnerabilità di github.com/mattermost/mattermost-server

Vedi tutto →