CVE-2017-18885 — Improper Privilege Management in Mattermost Mattermost-server

CWE-269 — Improper Privilege Management5 documents4 sources
Severity
9.8CRITICALNVD
EPSS
0.4%
top 38.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Github.com Mattermost Mattermost-serverMattermost Server
Timeline
PublishedJun 19
Latest updateDec 15

Description

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDmattermost/mattermost_server4.2.0 — 4.2.1+2
▶Gogithub.com/mattermost_mattermost-server4.2.0-rc1+incompatible — 4.2.1+incompatible+5

🔴Vulnerability Details

4
OSV
Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials in github.com/mattermost/mattermost-server↗2025-12-15
▶
GHSA
Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials↗2022-05-24
▶
OSV
Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials↗2022-05-24
▶
CVEList
CVE-2017-18885: An issue was discovered in Mattermost Server before 4↗2020-06-19
▶
CVE-2017-18885 — Improper Privilege Management | cvebase