GitHub Advisoryadvisory · Go

GHSA-jxc4-w54c-qv5r Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations

HIGH Published 2022-05-24 Modified 2026-02-06 Official page ↗
Aliases
CVE-2017-18917
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-328
Reviewed
2026-02-06

Affected packages

• Go github.com/mattermost/mattermost-server: < 3.7.5-0.20170421192444-247cd1e51a8c → fixed in 3.7.5-0.20170421192444-247cd1e51a8c • Go github.com/mattermost/mattermost-server: >= 3.8.0, < 3.8.2 → fixed in 3.8.2

Description

An issue was discovered in Mattermost Server before 3.8.2 and 3.7.5. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.

Related

Alias · CVE (1)

  • CVE-2017-18917 An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. vulnerability

Weakness · CWE (1)

  • CWE-328 Use of Weak Hash weakness

References