PT-2020-8906 · Mattermost · Mattermost Server

Published 2020-06-19 · Updated 2020-06-25 · CVE-2018-21263

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 4.7.0 Mattermost Server version 4.6.2 and earlier Mattermost Server version 4.5.2 and earlier

Description An issue allows an attacker to authenticate to a different user's account via a crafted SAML response.

Recommendations For versions prior to 4.7.0, update to version 4.7.0 or later. For version 4.6.2 and earlier, update to version 4.6.2 or later, then further update to version 4.7.0 or later. For version 4.5.2 and earlier, update to version 4.5.2 or later, then further update to version 4.7.0 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-21263

Affected Products

Mattermost Server

References · 3

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-21263 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-21263 · Security Note