{"id":"CVE-2017-18905","published":"2020-06-19T19:17:03Z","modified":"2024-08-05T21:37:44Z","title":"An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service…","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00775,"percentile":0.55641,"provenance":"source"},"cwes":[],"references":[{"url":"https://mattermost.com/security-updates/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":11.1,"factors":[{"name":"EPSS percentile","points":11.13}]},"affected":[{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server","vulnerableRanges":["<3.9.2",">=3.10.0, <3.10.2","<3.9.2+incompatible",">=3.10.0+incompatible, <3.10.2+incompatible"],"patched":["3.9.2","3.10.2","3.9.2+incompatible","3.10.2+incompatible"],"from":["GHSA-g24c-fx4v-xg9w","GO-2026-4306"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-9995","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-github-com-mattermost-mattermost-server-cve-2016-11068","parents":[{"from":"CVE-2017-18872","to":"CVE-2017-18905","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api4/oauth.go"],"commits":["https://github.com/mattermost/mattermost/commit/8f6bb1570dd234c63de5241eff9fbb268aad358c","https://github.com/mattermost/mattermost/commit/753386c2b2b06233d8bd977e3db29a4fe18098cb","https://github.com/mattermost/mattermost/commit/15ad24d160cb4604d0605ebbfa53d11a57820706","https://github.com/mattermost/mattermost/commit/b17fca0d5ee7557e3df1cf1d1da8bd749859e35f"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.48,"basis":"same package + description similarity"}]}],"children":[{"from":"CVE-2017-18905","to":"CVE-2017-18915","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api/oauth.go","api/user.go"],"commits":["https://github.com/mattermost/mattermost/commit/15ad24d160cb4604d0605ebbfa53d11a57820706","https://github.com/mattermost/mattermost/commit/b17fca0d5ee7557e3df1cf1d1da8bd749859e35f","https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423"],"basis":"shared function","functions":["emailToOAuth"]}]}],"packageHistory":[{"cve":"CVE-2017-18908","published":"2020-06-19","fixed":"3.10.1+incompatible","kev":false,"link":{"from":"CVE-2017-18908","to":"CVE-2017-18905","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"3.9.1-rc1+incompatible","toFixed":"3.9.2","daysApart":0}]}},{"cve":"CVE-2017-18903","published":"2020-06-19","fixed":"3.10.2+incompatible","kev":false},{"cve":"CVE-2017-18904","published":"2020-06-19","fixed":"3.10.2+incompatible","kev":false},{"cve":"CVE-2017-18905","published":"2020-06-19","fixed":"3.10.2+incompatible","kev":false},{"cve":"CVE-2017-18906","published":"2020-06-19","fixed":"3.10.2+incompatible","kev":false},{"cve":"CVE-2017-18907","published":"2020-06-19","fixed":"3.10.2+incompatible","kev":false},{"cve":"CVE-2017-18900","published":"2020-06-19","fixed":"4.0.3+incompatible","kev":false}],"package":"Go:github.com/mattermost/mattermost-server"}}