CVE-2017-18895 — Sensitive Information Exposure in Mattermost Mattermost-server

CWE-200 — Sensitive Information Exposure5 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.2%
top 53.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Github.com Mattermost Mattermost-serverMattermost Server
Timeline
PublishedJun 19
Latest updateJan 13

Description

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information (user statuses) via a REST API version 4 endpoint.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDmattermost/mattermost_server4.1.0 — 4.1.1+2

🔴Vulnerability Details

4
OSV
Mattermost Server exposes sensitive user status information via REST API version 4 endpoint in github.com/mattermost/mattermost-server↗2026-01-13
▶
OSV
Mattermost Server exposes sensitive user status information via REST API version 4 endpoint↗2022-05-24
▶
GHSA
Mattermost Server exposes sensitive user status information via REST API version 4 endpoint↗2022-05-24
▶
CVEList
CVE-2017-18895: An issue was discovered in Mattermost Server before 4↗2020-06-19
▶
CVE-2017-18895 — Sensitive Information Exposure | cvebase