GitHub Advisoryadvisory · Go

GHSA-w8cc-3h7q-jhc3 Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider

MEDIUM Published 2022-05-24 Modified 2025-12-05 Official page ↗
Aliases
CVE-2017-18883
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-331
Reviewed
2025-12-05

Affected packages

• Go github.com/mattermost/mattermost-server: < 4.1.2 → fixed in 4.1.2 • Go github.com/mattermost/mattermost-server: >= 4.2.0-rc1, < 4.2.1 → fixed in 4.2.1 • Go github.com/mattermost/mattermost-server: >= 4.3.0-rc1, < 4.3.0 → fixed in 4.3.0

Description

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.

Related

Alias · CVE (1)

  • CVE-2017-18883 An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. vulnerability

Weakness · CWE (1)

  • CWE-331 Insufficient Entropy weakness

References