{"id":"CVE-2017-18872","published":"2020-06-19T17:44:11Z","modified":"2024-08-05T21:37:44Z","title":"An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00569,"percentile":0.47014,"provenance":"source"},"cwes":[],"references":[{"url":"https://mattermost.com/security-updates/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":9.4,"factors":[{"name":"EPSS percentile","points":9.4}]},"affected":[{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server","vulnerableRanges":["<4.3.3",">=4.4.0-rc1, <4.4.3","<4.3.3+incompatible",">=4.4.0-rc1+incompatible, <4.4.3+incompatible"],"patched":["4.3.3","4.4.3","4.3.3+incompatible","4.4.3+incompatible"],"from":["GHSA-hgrp-fgm8-56g8","GO-2025-4075"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-9962","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-github-com-mattermost-mattermost-server-cve-2016-11068","children":[{"from":"CVE-2017-18872","to":"CVE-2017-18905","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api4/oauth.go"],"commits":["https://github.com/mattermost/mattermost/commit/8f6bb1570dd234c63de5241eff9fbb268aad358c","https://github.com/mattermost/mattermost/commit/753386c2b2b06233d8bd977e3db29a4fe18098cb","https://github.com/mattermost/mattermost/commit/15ad24d160cb4604d0605ebbfa53d11a57820706","https://github.com/mattermost/mattermost/commit/b17fca0d5ee7557e3df1cf1d1da8bd749859e35f"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.48,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2017-18888","published":"2020-06-19","fixed":"4.3.0+incompatible","kev":false},{"cve":"CVE-2017-18889","published":"2020-06-19","fixed":"4.3.0+incompatible","kev":false},{"cve":"CVE-2017-18890","published":"2020-06-19","fixed":"4.3.0+incompatible","kev":false},{"cve":"CVE-2017-18872","published":"2020-06-19","fixed":"4.4.3+incompatible","kev":false},{"cve":"CVE-2017-18871","published":"2020-06-19","fixed":"4.5.0+incompatible","kev":false,"link":{"from":"CVE-2017-18872","to":"CVE-2017-18871","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"4.3.3+incompatible","toFixed":"4.3.4","daysApart":0}]}},{"cve":"CVE-2018-21258","published":"2020-06-19","fixed":"5.1.0","kev":false},{"cve":"CVE-2023-5968","published":"2023-11-06","fixed":"5.3.2-0.20230825233148-f787fd63368a","kev":false}],"package":"Go:github.com/mattermost/mattermost-server"}}