CVE-2017-18909 — Improper Certificate Validation in Mattermost Mattermost-server

CWE-295 — Improper Certificate ValidationCWE-311 — Missing Encryption of Sensitive DataCWE-347 — Improper Verification of Cryptographic Signature5 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 64.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Github.com Mattermost Mattermost-serverMattermost Server
Timeline
PublishedJun 19
Latest updateFeb 17

Description

An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶Gogithub.com/mattermost_mattermost-server< 3.8.1-0.20170504181128-4f074fed0d65

🔴Vulnerability Details

4
OSV
Mattermost Server SAML implementation does not require encryption or signature verification as default in github.com/mattermost/mattermost-server↗2026-02-17
▶
GHSA
Mattermost Server SAML implementation does not require encryption or signature verification as default↗2022-05-24
▶
OSV
Mattermost Server SAML implementation does not require encryption or signature verification as default↗2022-05-24
▶
CVEList
CVE-2017-18909: An issue was discovered in Mattermost Server before 3↗2020-06-19
▶
CVE-2017-18909 — Improper Certificate Validation | cvebase