CVE-2018-21251

2020-06-1917:15:12

Google

osv.dev

6.8 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

65.7%

JSON

An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body.

CPENameOperatorVersion
mattermost-servereq4.5.1
mattermost-servereq4.5.0-rc4
mattermost-servereq3.0.3
mattermost-servereq4.7.1-rc1
mattermost-servereq4.5.0-rc2
mattermost-servereq4.8.0
mattermost-servereq5.1.0-rc3
mattermost-servereq4.3.0-rc2
mattermost-servereq4.1.0
mattermost-servereq3.4.0

Name	Operator	Version
mattermost-server	eq	4.5.1
mattermost-server	eq	4.5.0-rc4
mattermost-server	eq	3.0.3
mattermost-server	eq	4.7.1-rc1
mattermost-server	eq	4.5.0-rc2
mattermost-server	eq	4.8.0
mattermost-server	eq	5.1.0-rc3
mattermost-server	eq	4.3.0-rc2
mattermost-server	eq	4.1.0
mattermost-server	eq	3.4.0

Rows per page:

1-10 of 1051

References

mattermost.com/security-updates/