GitHub Advisoryadvisory · Go

GHSA-hgrp-fgm8-56g8 Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization

MEDIUM Published 2022-05-24 Modified 2025-10-24 Official page ↗
Aliases
CVE-2017-18872
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-862
Reviewed
2025-10-24

Affected packages

• Go github.com/mattermost/mattermost-server: < 4.3.3 → fixed in 4.3.3 • Go github.com/mattermost/mattermost-server: >= 4.4.0-rc1, < 4.4.3 → fixed in 4.4.3

Description

An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.

Related

Alias · CVE (1)

  • CVE-2017-18872 An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References