{"id":"CVE-2017-18915","published":"2020-06-19T19:16:03Z","modified":"2024-08-05T21:37:44Z","title":"An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01184,"percentile":0.67689,"provenance":"source"},"cwes":[],"references":[{"url":"https://mattermost.com/security-updates/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":13.5,"factors":[{"name":"EPSS percentile","points":13.54}]},"affected":[{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server","vulnerableRanges":["<3.6.7-0.20170420152529-0968e4079e0a",">=3.7.0, <3.7.5",">=3.8.0, <3.8.2",">=3.7.0+incompatible, <3.7.5+incompatible",">=3.8.0+incompatible, <3.8.2+incompatible"],"patched":["3.6.7-0.20170420152529-0968e4079e0a","3.7.5","3.8.2","3.7.5+incompatible","3.8.2+incompatible"],"from":["GHSA-hxxj-8phw-74vw","GO-2026-4462"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-10005","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-github-com-mattermost-mattermost-server-cve-2016-11068","parents":[{"from":"CVE-2017-18911","to":"CVE-2017-18915","relation":"successor","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"3.6.7-rc1+incompatible","toFixed":"3.6.7-0.20170420152529-0968e4079e0a","daysApart":0},{"kind":"same-code","provenance":"machine","files":["api/context.go","api/oauth.go"],"commits":["https://github.com/mattermost/mattermost/commit/222bce0c5c1abb2f58c3a6de1fe8c5d3accffb21","https://github.com/mattermost/mattermost/commit/691c18157025d4808b5b11de1d6de01050e54fa6","https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423"],"basis":"shared function","functions":["GetAuthorizationCode","ServeHTTP","authorizeOAuth","completeOAuth"]}]},{"from":"CVE-2016-11068","to":"CVE-2017-18915","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api/admin.go"],"commits":["https://github.com/mattermost/mattermost/commit/6c5a8be6bfe1d6b9d8f71a6b0dc4d8cf93a03aab","https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423"],"basis":"shared function","functions":["adminResetPassword"]}]},{"from":"CVE-2016-11069","to":"CVE-2017-18915","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api/user.go"],"commits":["https://github.com/mattermost/mattermost/commit/c976c2881ce5e34febac8a9850a6bad5d728625e","https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423"],"basis":"shared function","functions":["updatePassword"]}]},{"from":"CVE-2016-11083","to":"CVE-2017-18915","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api/file.go"],"commits":["https://github.com/mattermost/mattermost/commit/480308b7029a04cf41d0e9e7cd68b52dc2138e98","https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423"],"basis":"rarely changed file"}]},{"from":"CVE-2017-18873","to":"CVE-2017-18915","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["app/command.go","app/post.go","app/webhook.go"],"commits":["https://github.com/mattermost/mattermost/commit/9adaf53e110e0e806b21903111aacb93129668cb","https://github.com/mattermost/mattermost/commit/b3e4b0ac91682093276a653f7ccd5774aaa9cd06","https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423"],"basis":"shared function","functions":["CreateCommandPost","CreatePostAsUser","CreateWebhookPost"]}]},{"from":"CVE-2017-18874","to":"CVE-2017-18915","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api4/user.go"],"commits":["https://github.com/mattermost/mattermost/commit/6be8113eb60cf5ddd2dc1c3f4db05cae0c183086","https://github.com/mattermost/mattermost/commit/6d3cb2ce07fc799832081e93843b405b390057fa","https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423"],"basis":"shared function","functions":["patchUser","updateUser","updateUserMfa"]}]},{"from":"CVE-2017-18875","to":"CVE-2017-18915","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api4/user.go"],"commits":["https://github.com/mattermost/mattermost/commit/6be8113eb60cf5ddd2dc1c3f4db05cae0c183086","https://github.com/mattermost/mattermost/commit/6d3cb2ce07fc799832081e93843b405b390057fa","https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423"],"basis":"shared function","functions":["patchUser","updateUser","updateUserMfa"]}]},{"from":"CVE-2017-18876","to":"CVE-2017-18915","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api4/user.go"],"commits":["https://github.com/mattermost/mattermost/commit/6be8113eb60cf5ddd2dc1c3f4db05cae0c183086","https://github.com/mattermost/mattermost/commit/6d3cb2ce07fc799832081e93843b405b390057fa","https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423"],"basis":"shared function","functions":["patchUser","updateUser","updateUserMfa"]}]},{"from":"CVE-2017-18878","to":"CVE-2017-18915","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api4/user.go"],"commits":["https://github.com/mattermost/mattermost/commit/6be8113eb60cf5ddd2dc1c3f4db05cae0c183086","https://github.com/mattermost/mattermost/commit/8fbbd688ea2466dd0d70e9c07e9703d78f8a19a5","https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423"],"basis":"shared function","functions":["patchUser","updateUser","updateUserMfa"]}]},{"from":"CVE-2017-18901","to":"CVE-2017-18915","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api/team.go"],"commits":["https://github.com/mattermost/mattermost/commit/5e822a7d09214d5446d54e02a0611df8e64f3aa5","https://github.com/mattermost/mattermost/commit/638c38cc0d2296335a0fbd5bde8b6d2cbf9f9062","https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423"],"basis":"rarely changed file"}]},{"from":"CVE-2017-18904","to":"CVE-2017-18915","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api/file.go","api4/file.go"],"commits":["https://github.com/mattermost/mattermost/commit/6a2754376c8c8270be5e11e3fdab589659d0cc8d","https://github.com/mattermost/mattermost/commit/bde06a7bc3a03a56da224c1ffcd8bffb0af8071b","https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423"],"basis":"rarely changed file"}]},{"from":"CVE-2017-18905","to":"CVE-2017-18915","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api/oauth.go","api/user.go"],"commits":["https://github.com/mattermost/mattermost/commit/15ad24d160cb4604d0605ebbfa53d11a57820706","https://github.com/mattermost/mattermost/commit/b17fca0d5ee7557e3df1cf1d1da8bd749859e35f","https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423"],"basis":"shared function","functions":["emailToOAuth"]}]}],"children":[{"from":"CVE-2017-18915","to":"CVE-2017-18917","relation":"successor","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"3.7.5+incompatible","toFixed":"3.7.5-0.20170421192444-247cd1e51a8c","daysApart":0},{"kind":"same-code","provenance":"machine","files":["api/oauth.go","api/user.go","app/team.go","app/user.go"],"commits":["https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423","https://github.com/mattermost/mattermost/commit/b74e85653660525d351d090a1e1874ae933bcbc8","https://github.com/mattermost/mattermost/commit/247cd1e51a8c943628dc650e87e794b06aad4c2b"],"basis":"shared function","functions":["CreateUserWithHash","GetAuthorizationCode"]}]},{"from":"CVE-2017-18915","to":"CVE-2017-18918","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api/admin.go"],"commits":["https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423","https://github.com/mattermost/mattermost/commit/8ec37570742b67fd640bb3434ea226c655dbf408","https://github.com/mattermost/mattermost/commit/a12e7fdca439948ab097431d68e8f59778fbab81"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2017-18912","published":"2020-06-19","fixed":"3.7.4-0.20170404171331-0b5c0794fdcb","kev":false,"link":{"from":"CVE-2017-18912","to":"CVE-2017-18915","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"3.7.4-0.20170404171331-0b5c0794fdcb","toFixed":"3.7.5","daysApart":0}]}},{"cve":"CVE-2017-18909","published":"2020-06-19","fixed":"3.8.1-0.20170504181128-4f074fed0d65","kev":false},{"cve":"CVE-2017-18911","published":"2020-06-19","fixed":"3.8.2+incompatible","kev":false},{"cve":"CVE-2017-18915","published":"2020-06-19","fixed":"3.8.2+incompatible","kev":false},{"cve":"CVE-2017-18916","published":"2020-06-19","fixed":"3.8.2+incompatible","kev":false},{"cve":"CVE-2017-18917","published":"2020-06-19","fixed":"3.8.2+incompatible","kev":false},{"cve":"CVE-2017-18908","published":"2020-06-19","fixed":"3.10.1+incompatible","kev":false}],"package":"Go:github.com/mattermost/mattermost-server"}}