GHSA-x33g-375j-jhf7

Mattermost Server has Improper Authorization for Integration Requests

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-18916

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/mattermost/mattermost-server	< 3.6.7-0.20170420152529-0968e4079e0a	3.6.7-0.20170420152529-0968e4079e0a
Go	github.com/mattermost/mattermost-server	>= 3.7.0, < 3.7.5	3.7.5
Go	github.com/mattermost/mattermost-server	>= 3.8.0, < 3.8.2	3.8.2

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-18916 advisory
https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877 web
https://github.com/mattermost/mattermost/commit/b74e85653660525d351d090a1e1874ae933bcbc8 web
https://github.com/mattermost/mattermost/commit/fb325cc339eb8d8efb60dbadc48fd38897201c6f web
https://github.com/mattermost/mattermost package
https://mattermost.com/security-updates web