GitHub Advisoryadvisory · Go

GHSA-r6j5-fqx9-7qv9 Mattermost Server SAML implementation does not require encryption or signature verification as default

HIGH Published 2022-05-24 Modified 2026-02-10 Official page ↗
Aliases
CVE-2017-18909
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-311, CWE-347
Reviewed
2026-02-06

Affected packages

• Go github.com/mattermost/mattermost-server: < 3.8.1-0.20170504181128-4f074fed0d65 → fixed in 3.8.1-0.20170504181128-4f074fed0d65

Description

An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory.

Related

Alias · CVE (1)

  • CVE-2017-18909 An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. vulnerability

Weakness · CWE (2)

  • CWE-311 Missing Encryption of Sensitive Data weakness
  • CWE-347 Improper Verification of Cryptographic Signature weakness

References