CVE-2017-18912
published 2020-06-19CVE-2017-18912: An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. It allows an attacker to specify a full pathname of a log file.
PriorityP346critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.39%
69.2th percentile
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. It allows an attacker to specify a full pathname of a log file.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 0 < 3.7.4-0.20170404171331-0b5c0794fdcb | 3.7.4-0.20170404171331-0b5c0794fdcb |
| mattermost | mattermost_server | < 3.6.7 | 3.6.7 |
| mattermost | mattermost_server | >= 3.7.0 < 3.7.5 | 3.7.5 |
| mattermost | mattermost_server | >= 3.8.0 < 3.8.2 | 3.8.2 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost Server allows an attacker to specify a full pathname of a log file in github.com/mattermost/mattermost-server
osv·2026-02-17
CVE-2017-18912 Mattermost Server allows an attacker to specify a full pathname of a log file in github.com/mattermost/mattermost-server
Mattermost Server allows an attacker to specify a full pathname of a log file in github.com/mattermost/mattermost-server
Mattermost Server allows an attacker to specify a full pathname of a log file in github.com/mattermost/mattermost-server.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/mattermost/mattermost-server before v3.7.4-0.20170404171331-0b5c0794fdcb.
GHSA
Mattermost Server allows an attacker to specify a full pathname of a log file
ghsa·2022-05-24
CVE-2017-18912 [HIGH] CWE-22 Mattermost Server allows an attacker to specify a full pathname of a log file
Mattermost Server allows an attacker to specify a full pathname of a log file
An issue was discovered in Mattermost Server before 3.7.5. It allows an attacker to specify a full pathname of a log file.
OSV
Mattermost Server allows an attacker to specify a full pathname of a log file
osv·2022-05-24
CVE-2017-18912 [HIGH] Mattermost Server allows an attacker to specify a full pathname of a log file
Mattermost Server allows an attacker to specify a full pathname of a log file
An issue was discovered in Mattermost Server before 3.7.5. It allows an attacker to specify a full pathname of a log file.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-06-19
Published