GitHub Advisoryadvisory · Go

GHSA-h564-6gc2-fcc6 Mattermost Server allows users with a session ID to revoke another users' session

MEDIUM Published 2022-05-24 Modified 2025-12-05 Official page ↗
Aliases
CVE-2017-18878
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-284, CWE-639, CWE-732
Reviewed
2025-12-05

Affected packages

• Go github.com/mattermost/mattermost-server: < 4.1.2-0.20171004201910-6be8113eb60c → fixed in 4.1.2-0.20171004201910-6be8113eb60c • Go github.com/mattermost/mattermost-server: >= 4.2.0-rc1, < 4.2.1-0.20171004192657-8fbbd688ea24 → fixed in 4.2.1-0.20171004192657-8fbbd688ea24 • Go github.com/mattermost/mattermost-server: >= 4.3.0-rc1, < 4.3.0 → fixed in 4.3.0

Description

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.

Related

Alias · CVE (1)

  • CVE-2017-18878 An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. vulnerability

Weakness · CWE (3)

  • CWE-284 Improper Access Control weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References