CVE-2017-18883 — Insufficient Entropy in Mattermost Mattermost-server

CWE-331 — Insufficient Entropy5 documents4 sources
Severity
9.1CRITICALNVD
EPSS
0.3%
top 45.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Github.com Mattermost Mattermost-serverMattermost Server
Timeline
PublishedJun 19
Latest updateDec 8

Description

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages2 packages

▶NVDmattermost/mattermost_server4.2.0 — 4.2.1+2
▶Gogithub.com/mattermost_mattermost-server4.2.0-rc1+incompatible — 4.2.1+incompatible+5

🔴Vulnerability Details

4
OSV
Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider in github.com/mattermost/mattermost-server↗2025-12-08
▶
GHSA
Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider↗2022-05-24
▶
OSV
Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider↗2022-05-24
▶
CVEList
CVE-2017-18883: An issue was discovered in Mattermost Server before 4↗2020-06-19
▶
CVE-2017-18883 — Insufficient Entropy | cvebase