Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-18905US | medium5.3 | — | ||
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/mattermost/mattermostPACKAGE
- https://github.com/mattermost/mattermost/commit/15ad24d160cb4604d0605ebbfa53d11a57820706WEB
- https://github.com/mattermost/mattermost/commit/b17fca0d5ee7557e3df1cf1d1da8bd749859e35fWEB
- https://github.com/mattermost/mattermost/commit/fbc170733e86f09b46ba754dd03304733d2f482fWEB
- https://mattermost.com/security-updatesWEB
- https://nvd.nist.gov/vuln/detail/CVE-2017-18905ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan