CVE-2018-21251

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2018-21251

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-21251.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-21251

Published

2020-06-19T17:15:12.490Z

Modified

2026-07-08T05:54:32.645953728Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:mattermost:mattermost_server:5.2.0:rc1:*:*:*:*:*:*",
                "cpe:2.3:a:mattermost:mattermost_server:5.2.0:rc3:*:*:*:*:*:*",
                "cpe:2.3:a:mattermost:mattermost_server:5.2.0:rc5:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "introduced": "5.2.0-rc1"
                },
                {
                    "last_affected": "5.2.0-rc1"
                },
                {
                    "introduced": "5.2.0-rc3"
                },
                {
                    "last_affected": "5.2.0-rc3"
                },
                {
                    "introduced": "5.2.0-rc5"
                },
                {
                    "last_affected": "5.2.0-rc5"
                }
            ],
            "vendor_product": "mattermost:mattermost_server"
        }
    ]
}

References

https://mattermost.com/security-updates/

Affected packages

Git / github.com/mattermost/mattermost

Affected ranges

Type

GIT

Repo

https://github.com/mattermost/mattermost

Events

Introduced

Fixed

77274a7aca64491a1898d4e4239158817a503a8e

Introduced

9bf01f1401ed47afc4fc443974e2bd4db50b2f50

Last affected

43483805eabcb36ef9018f12a82a6d3ac055baf5

Database specific

{
    "cpe": [
        "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:mattermost:mattermost_server:5.2.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:mattermost:mattermost_server:5.2.0:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:mattermost:mattermost_server:5.2.0:rc3:*:*:*:*:*:*",
        "cpe:2.3:a:mattermost:mattermost_server:5.2.0:rc4:*:*:*:*:*:*",
        "cpe:2.3:a:mattermost:mattermost_server:5.2.0:rc5:*:*:*:*:*:*",
        "cpe:2.3:a:mattermost:mattermost_server:5.2.0:rc6:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.1.1"
        },
        {
            "introduced": "5.2.0-rc1"
        },
        {
            "last_affected": "5.2.0-rc1"
        },
        {
            "introduced": "5.2.0-rc2"
        },
        {
            "last_affected": "5.2.0-rc2"
        },
        {
            "introduced": "5.2.0-rc3"
        },
        {
            "last_affected": "5.2.0-rc3"
        },
        {
            "introduced": "5.2.0-rc4"
        },
        {
            "last_affected": "5.2.0-rc4"
        },
        {
            "introduced": "5.2.0-rc5"
        },
        {
            "last_affected": "5.2.0-rc5"
        },
        {
            "introduced": "5.2.0-rc6"
        },
        {
            "last_affected": "5.2.0-rc6"
        }
    ]
}

Affected versions

5.*

5.2.0-rc1

5.2.0-rc3

5.2.0-rc5

v0.*

v0.5.0

v4.*

v4.10.0-rc1

v4.2.0-rc1

v4.3.0-rc1

v4.4.0-rc1

v4.5.0-rc1

v4.6.0-rc1

v4.6.0-rc2

v4.7.0-rc1

v4.8.0-rc1

v4.9.0-rc1

v5.*

v5.0.0-rc1

v5.1.0

v5.1.0-rc1

v5.1.0-rc2

v5.1.0-rc3

v5.1.0-rc4

v5.2.0

v5.2.0-rc1

v5.2.0-rc2

v5.2.0-rc3

v5.2.0-rc4

v5.2.0-rc5

v5.2.0-rc6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-21251.json"