PT-2020-8005 · Mattermost · Mattermost Server

Published 2020-06-19 · Updated 2025-11-07 · CVE-2016-11076

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.0.0

Description: The issue arises because the software does not ensure that a cookie is used over SSL. This could potentially expose sensitive information.

Recommendations: For versions prior to 3.0.0, update to version 3.0.0 or later to ensure that cookies are used over SSL. As a temporary workaround, consider configuring the server to only use SSL connections to mitigate the risk of exploitation. Restrict access to sensitive areas of the server until the update is applied.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-614

CWE-295

Related Identifiers

CVE-2016-11076

GHSA-379P-37XC-Q963

GO-2025-4054

OPENSUSE-SU-2025:15710-1

Affected Products

Mattermost Server

References · 81

• https://osv.dev/vulnerability/GO-2025-4054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-11076 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-11076 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-379p-37xc-q963 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/bac25154d659883c801b3bb9a0687f46570f5bbf · Note
• https://suse.com/security/cve/CVE-2025-58356 · Note
• https://suse.com/security/cve/CVE-2025-61141 · Note
• https://suse.com/security/cve/CVE-2025-64102 · Note
• https://suse.com/security/cve/CVE-2025-62375 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-11076 · Note
• https://suse.com/security/cve/CVE-2016-11074 · Note
• https://suse.com/security/cve/CVE-2025-58075 · Note