{"id":"CVE-2017-18916","published":"2020-06-19T19:19:12Z","modified":"2024-08-05T21:37:44Z","title":"An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00775,"percentile":0.55795,"provenance":"source"},"cwes":[],"references":[{"url":"https://mattermost.com/security-updates/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":11.2,"factors":[{"name":"EPSS percentile","points":11.16}]},"affected":[{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server","vulnerableRanges":["<3.6.7-0.20170420152529-0968e4079e0a",">=3.7.0, <3.7.5",">=3.8.0, <3.8.2",">=3.7.0+incompatible, <3.7.5+incompatible",">=3.8.0+incompatible, <3.8.2+incompatible"],"patched":["3.6.7-0.20170420152529-0968e4079e0a","3.7.5","3.8.2","3.7.5+incompatible","3.8.2+incompatible"],"from":["GHSA-x33g-375j-jhf7","GO-2026-4467"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-10006","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2017-18912","published":"2020-06-19","fixed":"3.7.4-0.20170404171331-0b5c0794fdcb","kev":false,"link":{"from":"CVE-2017-18912","to":"CVE-2017-18916","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"3.7.4-0.20170404171331-0b5c0794fdcb","toFixed":"3.7.5","daysApart":0}]}},{"cve":"CVE-2017-18909","published":"2020-06-19","fixed":"3.8.1-0.20170504181128-4f074fed0d65","kev":false},{"cve":"CVE-2017-18911","published":"2020-06-19","fixed":"3.8.2+incompatible","kev":false,"link":{"from":"CVE-2017-18911","to":"CVE-2017-18916","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"3.6.7-rc1+incompatible","toFixed":"3.6.7-0.20170420152529-0968e4079e0a","daysApart":0}]}},{"cve":"CVE-2017-18915","published":"2020-06-19","fixed":"3.8.2+incompatible","kev":false},{"cve":"CVE-2017-18916","published":"2020-06-19","fixed":"3.8.2+incompatible","kev":false},{"cve":"CVE-2017-18917","published":"2020-06-19","fixed":"3.8.2+incompatible","kev":false},{"cve":"CVE-2017-18908","published":"2020-06-19","fixed":"3.10.1+incompatible","kev":false},{"cve":"CVE-2017-18903","published":"2020-06-19","fixed":"3.10.2+incompatible","kev":false}],"package":"Go:github.com/mattermost/mattermost-server"}}