PT-2020-8463 · Mattermost · Mattermost Server

Published 2020-06-19 · Updated 2026-03-03 · CVE-2017-18917

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7

Description: An issue was discovered related to weak hashing used for e-mail invitations, OAuth, and e-mail verification tokens.

Recommendations: For versions prior to 3.8.2, update to version 3.8.2 or later. For versions prior to 3.7.5, update to version 3.7.5 or later. For versions prior to 3.6.7, update to version 3.6.7 or later.

Fix

Weakness Enumeration

CWE-328

CWE-916

Related Identifiers

CVE-2017-18917

GHSA-JXC4-W54C-QV5R

GO-2026-4463

SUSE-SU-2026:0757-1

Affected Products

Mattermost Server

References · 116

• https://nvd.nist.gov/vuln/detail/CVE-2017-18917 · Security Note
• https://osv.dev/vulnerability/GHSA-jxc4-w54c-qv5r · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-18917 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4463 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/b74e85653660525d351d090a1e1874ae933bcbc8 · Note
• https://github.com/mattermost/mattermost/commit/247cd1e51a8c943628dc650e87e794b06aad4c2b · Note
• https://suse.com/security/cve/CVE-2025-64111 · Note
• https://suse.com/security/cve/CVE-2026-0998 · Note
• https://suse.com/security/cve/CVE-2026-24122 · Note
• https://suse.com/security/cve/CVE-2026-22892 · Note
• https://suse.com/security/cve/CVE-2026-21434 · Note
• https://suse.com/security/cve/CVE-2026-25760 · Note