GHSA-r6j5-fqx9-7qv9

Source

https://github.com/advisories/GHSA-r6j5-fqx9-7qv9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-r6j5-fqx9-7qv9/GHSA-r6j5-fqx9-7qv9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-r6j5-fqx9-7qv9

Aliases

Published

2022-05-24T17:21:06Z

Modified

2026-02-19T20:41:06Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Mattermost Server SAML implementation does not require encryption or signature verification as default

Details

An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory.

Database specific

{
    "cwe_ids":  [
        "CWE-311",
        "CWE-347"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-06T22:50:29Z",
    "nvd_published_at":  "2020-06-19T19:15:00Z",
    "severity":  "HIGH"
}

References

Affected packages

Go / github.com/mattermost/mattermost-server

Package

Name: github.com/mattermost/mattermost-server; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost-server

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.8.1-0.20170504181128-4f074fed0d65

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-r6j5-fqx9-7qv9/GHSA-r6j5-fqx9-7qv9.json"