« Back to list

CVE-2017-18883

Status: ModifiedCritical (9.1)—

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Mattermost — Mattermost Server

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2017-18883",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-06-19T19:15:10.310",
  "references": [
    {
      "url": "https://mattermost.com/security-updates/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://mattermost.com/security-updates/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-331"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data."
    },
    {
      "lang": "es",
      "value": "Se detectó un problema en Mattermost Server versiones anteriores a 4.3.0, 4.2.1 y 4.1.2, cuando sirve como proveedor de servicios OAuth versión 2.0. Hay poca entropía para los datos de autorización"
    }
  ],
  "lastModified": "2026-06-17T01:13:45.420",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72250CFB-47F9-40AE-BBD0-179D27CCF49D",
              "versionEndExcluding": "4.1.2"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FE7E6F1-5B34-4D19-8B93-ED2E9EFFCAF3",
              "versionEndExcluding": "4.2.1",
              "versionStartIncluding": "4.2.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:4.3.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB71A82C-2F6A-49EC-A541-1600304F4D37"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:4.3.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91E5A299-021B-451B-95E2-4DC2DD6FF50B"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:4.3.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "471DFF36-36F3-4904-B5E9-091C259181A6"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:4.3.0:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8772DEC-C002-443E-9609-1CC2A6FD8037"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}