PT-2020-8430 · Mattermost · Mattermost Server

Published 2020-06-19 · Updated 2025-12-15 · CVE-2017-18884

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2

Description: An issue was discovered in Mattermost Server that allows attackers to gain privileges by using a registered OAuth application with personal access tokens.

Recommendations: For Mattermost Server versions prior to 4.3.0, update to version 4.3.0 or later. For Mattermost Server version 4.2.1, update to version 4.3.0 or later. For Mattermost Server version 4.1.2, update to version 4.3.0 or later. As a temporary workaround, consider restricting the use of registered OAuth applications with personal access tokens until a patch is available.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2017-18884

GHSA-876J-JFQF-M7J7

GO-2025-4197

SUSE-SU-2025:4395-1

Affected Products

Mattermost Server

References · 46

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4197 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18884 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18884 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4395-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2017-18884 · Note
• https://suse.com/security/cve/CVE-2017-18871 · Note
• https://suse.com/security/cve/CVE-2025-12756 · Note
• https://suse.com/security/cve/CVE-2025-65025 · Note
• https://suse.com/security/cve/CVE-2025-13870 · Note
• https://suse.com/security/cve/CVE-2025-66564 · Note
• https://suse.com/security/cve/CVE-2025-61727 · Note
• https://suse.com/security/cve/CVE-2025-64443 · Note
• https://suse.com/security/cve/CVE-2025-13353 · Note
• https://suse.com/security/cve/CVE-2025-64761 · Note