{"id":"CVE-2017-18876","published":"2020-06-19T16:50:02Z","modified":"2024-08-05T21:37:44Z","title":"An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00869,"percentile":0.58655,"provenance":"source"},"cwes":[],"references":[{"url":"https://mattermost.com/security-updates/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":11.7,"factors":[{"name":"EPSS percentile","points":11.73}]},"affected":[{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server","vulnerableRanges":["<4.1.2-0.20171004201910-6be8113eb60c",">=4.2.0-rc1.0.20171004154238-fadd9514f6e7, <4.2.1-0.20171004194140-6d3cb2ce07fc",">=4.3.0-rc1, <4.3.0",">=4.3.0-rc1+incompatible, <4.3.0+incompatible"],"patched":["4.1.2-0.20171004201910-6be8113eb60c","4.2.1-0.20171004194140-6d3cb2ce07fc","4.3.0","4.3.0+incompatible"],"from":["GHSA-hjqh-j6rj-gh8q","GO-2025-4187"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-9966","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-github-com-mattermost-mattermost-server-cve-2016-11068","children":[{"from":"CVE-2017-18876","to":"CVE-2017-18915","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api4/user.go"],"commits":["https://github.com/mattermost/mattermost/commit/6be8113eb60cf5ddd2dc1c3f4db05cae0c183086","https://github.com/mattermost/mattermost/commit/6d3cb2ce07fc799832081e93843b405b390057fa","https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423"],"basis":"shared function","functions":["patchUser","updateUser","updateUserMfa"]}]}],"packageHistory":[{"cve":"CVE-2017-18873","published":"2020-06-19","fixed":"4.3.0+incompatible","kev":false,"link":{"from":"CVE-2017-18876","to":"CVE-2017-18873","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"4.1.2-0.20171004201910-6be8113eb60c","toFixed":"4.1.2-0.20171013141717-ee57a5829ab1","daysApart":0}]}},{"cve":"CVE-2017-18874","published":"2020-06-19","fixed":"4.3.0+incompatible","kev":false,"link":{"from":"CVE-2017-18874","to":"CVE-2017-18876","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"4.1.2-0.20171004201910-6be8113eb60","toFixed":"4.1.2-0.20171004201910-6be8113eb60c","daysApart":0},{"kind":"similar","provenance":"machine","score":0.51,"basis":"same package + description similarity"}]}},{"cve":"CVE-2017-18875","published":"2020-06-19","fixed":"4.3.0+incompatible","kev":false},{"cve":"CVE-2017-18876","published":"2020-06-19","fixed":"4.3.0+incompatible","kev":false},{"cve":"CVE-2017-18877","published":"2020-06-19","fixed":"4.3.0+incompatible","kev":false},{"cve":"CVE-2017-18878","published":"2020-06-19","fixed":"4.3.0+incompatible","kev":false,"link":{"from":"CVE-2017-18878","to":"CVE-2017-18876","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"4.2.1-0.20171004192657-8fbbd688ea24","toFixed":"4.2.1-0.20171004194140-6d3cb2ce07fc","daysApart":0}]}},{"cve":"CVE-2017-18879","published":"2020-06-19","fixed":"4.3.0+incompatible","kev":false}],"package":"Go:github.com/mattermost/mattermost-server"}}