CVE-2020-14460

Mattermost Server vulnerability CVE-2020-14460 affects versions prior to 5.19.0, including 5.18.1, 5.17.3, 5.16.5 and 5.9.8, where creating a trusted OAuth application may bypass admin privileges. Root cause details are not explicitly stated in the provided documents, but remediation is to upgrad...

CVE-2020-14460

An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001...

CVE-2020-14460

An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001...

CVE-2017-18883: Insufficient Entropy

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...

CVE-2020-14460: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001...

CVE-2017-18877: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page...

PT-2020-8443

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.2.0 Mattermost Server version 4.1.1 Mattermost Server version 4.0.5 Description: The issue concerns Mattermost Server when used as an OAuth 2.0 service provider. It mishandles a deny action for a...

CVE-2020-13272: Insufficient Verification of Data Authenticity

OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...

CVE-2017-18872: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...

CVE-2017-18884: Improper Privilege Management

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens...

CVE-2017-18905: Insufficient Session Expiration

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled...

CVE-2017-18917: Use of Password Hash With Insufficient Computational Effort

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens...

PT-2020-8429

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: An issue was discovered in Mattermost Server when serving as an OAuth 2.0 Service Provider, where there is low entropy for...

PT-2020-8452

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.0.0 Mattermost Server version 3.10.2 Mattermost Server version 3.9.2 Description: An issue was discovered when Single Sign-On OAuth2 is used, allowing an attacker to claim somebody else's account...

PT-2020-14020 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.19.0 Mattermost Server version 5.18.1 Mattermost Server version 5.17.3 Mattermost Server version 5.16.5 Mattermost Server version 5.9.8 Description: An issue was discovered where creation of a trusted OAu...

CVE-2017-18894: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Sometimes. resource-owner authorization is bypassed, allowing account takeover...

CVE-2017-18897: URL Redirection to Untrusted Site

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection...

[SECURITY] Fedora 31 Update: mod_auth_openidc-2.4.2.1-1.fc31

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server...

[SECURITY] Fedora 32 Update: mod_auth_openidc-2.4.2.1-1.fc32

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server...

What's the Best Approach to SSO and Consumer Session Management for Your Businesses?

If you want to see an argument break out among identity professionals, mention single sign-on SSO and consumer session management. As fast as this technology's evolved is as fast as it's become one of the most contentiously debated topics in the field. As a senior customer identity and access...