GitHub Advisoryadvisory · Go

GHSA-34cx-hvm4-vx7j Mattermost Server password reset email requests can be sent to attacker-provided email addresses

CRITICAL Published 2022-05-24 Modified 2026-02-10 Official page ↗
Aliases
CVE-2017-18908
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287, CWE-640
Reviewed
2026-02-06

Affected packages

• Go github.com/mattermost/mattermost-server: < 3.9.1-rc1 → fixed in 3.9.1-rc1 • Go github.com/mattermost/mattermost-server: >= 3.10.0, < 3.10.1 → fixed in 3.10.1

Description

An issue was discovered in Mattermost Server before 4.0.0, 3.10.1, and 3.9.1. A password reset request was sometimes sent to an attacker-provided e-mail address.

Related

Alias · CVE (1)

  • CVE-2017-18908 An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness

References