CVE-2017-18905

MEDIUM5.3EPSS 0.19%

Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider

Published: 5/24/2022Modified: 2/3/2026

Also known as:GHSA-g24c-fx4v-xg9wGO-2026-4306

Description

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.

Affected packages (2)

Go/github.com/mattermost/mattermost-serverfrom 0, < 3.9.2
Go/github.com/mattermost/mattermost-serverfrom 0, < 3.9.2+incompatible, >= 3.10.0+incompatible, < 3.10.2+incompatible

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References (7)

ADVISORYhttps://github.com/advisories/GHSA-g24c-fx4v-xg9w
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2017-18905
PATCHhttps://github.com/mattermost/mattermost
WEBhttps://github.com/mattermost/mattermost/commit/15ad24d160cb4604d0605ebbfa53d11a57820706
WEBhttps://github.com/mattermost/mattermost/commit/b17fca0d5ee7557e3df1cf1d1da8bd749859e35f
WEBhttps://github.com/mattermost/mattermost/commit/fbc170733e86f09b46ba754dd03304733d2f482f
WEBhttps://mattermost.com/security-updates