What is GHSA-34cx-hvm4-vx7j?

GHSA-34cx-hvm4-vx7j is a security advisory published by GitHub Security Advisories with Critical severity. Mattermost Server password reset email requests can be sent to attacker-provided email addresses

Which CVE IDs does GHSA-34cx-hvm4-vx7j cover?

GHSA-34cx-hvm4-vx7j covers the following CVE IDs: CVE-2017-18908. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-34cx-hvm4-vx7j?

GHSA-34cx-hvm4-vx7j has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-34cx-hvm4-vx7j?

GHSA-34cx-hvm4-vx7j affects 2 products, including: go/github.com/mattermost/mattermost-server:\u003c 3.9.1-rc1; go/github.com/mattermost/mattermost-server:\u003e= 3.10.0, \u003c 3.10.1.

GHSA-34cx-hvm4-vx7jCriticalCVSS 9.8

Mattermost Server password reset email requests can be sent to attacker-provided email addresses

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

February 10, 2026

🔗 CVE IDs covered (1)

CVE-2017-18908 →

📋 Description

An issue was discovered in Mattermost Server before 4.0.0, 3.10.1, and 3.9.1. A password reset request was sometimes sent to an attacker-provided e-mail address.

🎯 Affected products2

go/github.com/mattermost/mattermost-server:< 3.9.1-rc1
go/github.com/mattermost/mattermost-server:>= 3.10.0, < 3.10.1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2017-18908
https://github.com/mattermost/mattermost/commit/59139390ae927af2e879dbacfe4dadb1adac97c0
https://github.com/mattermost/mattermost/commit/d3bc11be3acd3a73e6358d958b91427e2584ea71
https://github.com/mattermost/mattermost/commit/e5065cf7575ee05c040945a4b00b7fd90bf39b83
https://mattermost.com/security-updates
https://github.com/advisories/GHSA-34cx-hvm4-vx7j