{"id":"CVE-2017-18918","published":"2020-06-19T19:19:57Z","modified":"2024-08-05T21:37:44Z","title":"An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00459,"percentile":0.39666,"provenance":"source"},"cwes":[],"references":[{"url":"https://mattermost.com/security-updates/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":7.9,"factors":[{"name":"EPSS percentile","points":7.93}]},"affected":[{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server","vulnerableRanges":["<3.6.5",">=3.7.0, <3.7.3","<3.6.5+incompatible",">=3.7.0+incompatible, <3.7.3+incompatible"],"patched":["3.6.5","3.7.3","3.6.5+incompatible","3.7.3+incompatible"],"from":["GHSA-5ghq-28r7-qwfj","GO-2026-4460"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-10008","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-github-com-mattermost-mattermost-server-cve-2016-11068","parents":[{"from":"CVE-2016-11068","to":"CVE-2017-18918","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api/admin.go"],"commits":["https://github.com/mattermost/mattermost/commit/6c5a8be6bfe1d6b9d8f71a6b0dc4d8cf93a03aab","https://github.com/mattermost/mattermost/commit/8ec37570742b67fd640bb3434ea226c655dbf408","https://github.com/mattermost/mattermost/commit/a12e7fdca439948ab097431d68e8f59778fbab81"],"basis":"rarely changed file"}]},{"from":"CVE-2017-18915","to":"CVE-2017-18918","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api/admin.go"],"commits":["https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423","https://github.com/mattermost/mattermost/commit/8ec37570742b67fd640bb3434ea226c655dbf408","https://github.com/mattermost/mattermost/commit/a12e7fdca439948ab097431d68e8f59778fbab81"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2016-11068","published":"2020-06-19","fixed":"3.2.0+incompatible","kev":false},{"cve":"CVE-2016-11069","published":"2020-06-19","fixed":"3.2.0+incompatible","kev":false},{"cve":"CVE-2016-11063","published":"2020-06-19","fixed":"3.5.1+incompatible","kev":false,"link":{"from":"CVE-2016-11063","to":"CVE-2017-18918","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"3.5.1+incompatible","toFixed":"3.6.5","daysApart":0}]}},{"cve":"CVE-2017-18918","published":"2020-06-19","fixed":"3.7.3+incompatible","kev":false},{"cve":"CVE-2017-18912","published":"2020-06-19","fixed":"3.7.4-0.20170404171331-0b5c0794fdcb","kev":false,"link":{"from":"CVE-2017-18918","to":"CVE-2017-18912","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"3.7.3+incompatible","toFixed":"3.7.4-0.20170404171331-0b5c0794fdcb","daysApart":0}]}},{"cve":"CVE-2017-18909","published":"2020-06-19","fixed":"3.8.1-0.20170504181128-4f074fed0d65","kev":false},{"cve":"CVE-2017-18911","published":"2020-06-19","fixed":"3.8.2+incompatible","kev":false,"link":{"from":"CVE-2017-18918","to":"CVE-2017-18911","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"3.6.5+incompatible","toFixed":"3.6.7-rc1","daysApart":0}]}}],"package":"Go:github.com/mattermost/mattermost-server"}}