{"id":"CVE-2016-11069","published":"2020-06-19T19:25:13Z","modified":"2024-08-06T03:47:34Z","title":"An issue was discovered in Mattermost Server before 3.2.0","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00899,"percentile":0.59497,"provenance":"source"},"cwes":[],"references":[{"url":"https://mattermost.com/security-updates/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":11.9,"factors":[{"name":"EPSS percentile","points":11.9}]},"affected":[{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server","vulnerableRanges":["<3.2.0","<3.2.0+incompatible"],"patched":["3.2.0","3.2.0+incompatible"],"from":["GHSA-qrf6-h5fc-7m96","GO-2025-4051"],"provenance":"source"}],"euvd":{"id":"EUVD-2016-2058","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-github-com-mattermost-mattermost-server-cve-2016-11068","children":[{"from":"CVE-2016-11069","to":"CVE-2017-18915","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api/user.go"],"commits":["https://github.com/mattermost/mattermost/commit/c976c2881ce5e34febac8a9850a6bad5d728625e","https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423"],"basis":"shared function","functions":["updatePassword"]}]}],"packageHistory":[{"cve":"CVE-2016-11066","published":"2020-06-19","fixed":"3.1.1","kev":false,"link":{"from":"CVE-2016-11066","to":"CVE-2016-11069","relation":"successor","confidence":"high","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"3.1.1","toFixed":"3.2.0","daysApart":0},{"kind":"same-code","provenance":"machine","files":["api/user.go"],"commits":["https://github.com/mattermost/mattermost/commit/f89e7c6d543a82d6078c2ca0f892914d7976a6f5","https://github.com/mattermost/mattermost/commit/c976c2881ce5e34febac8a9850a6bad5d728625e"],"basis":"shared file"}]}},{"cve":"CVE-2016-11067","published":"2020-06-19","fixed":"3.2.0+incompatible","kev":false},{"cve":"CVE-2016-11068","published":"2020-06-19","fixed":"3.2.0+incompatible","kev":false},{"cve":"CVE-2016-11069","published":"2020-06-19","fixed":"3.2.0+incompatible","kev":false},{"cve":"CVE-2016-11063","published":"2020-06-19","fixed":"3.5.1+incompatible","kev":false},{"cve":"CVE-2017-18918","published":"2020-06-19","fixed":"3.7.3+incompatible","kev":false},{"cve":"CVE-2017-18912","published":"2020-06-19","fixed":"3.7.4-0.20170404171331-0b5c0794fdcb","kev":false}],"package":"Go:github.com/mattermost/mattermost-server"}}