Mattermost Server SAML implementation does not require encryption or signature verification as default

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2017-18909 · ADVISORY
• mattermost/mattermost commit 4f074fe · WEB
• mattermost/mattermost · PACKAGE
• mattermost.com/security-updates · WEB
• mattermost.com/security-updates · Vendor Advisory
• GitHub Advisory GHSA-r6j5-fqx9-7qv9 · ADVISORY

Lỗ hổng khác của github.com/mattermost/mattermost-server

• CVE-2026-8823THẤP 3.8Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to validate bot targets when demoting users to guests which allows a lower-pr…
• CVE-2026-9162TRUNG BÌNH 4.3Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state…
• CVE-2026-8074THẤP 3.8Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint,…
• CVE-2026-6673TRUNG BÌNH 6.4Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to authenticate Atlassian Connect install…
• CVE-2026-6062TRUNG BÌNH 6.4Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an exist…