What is GHSA-m462-mqw4-2c8m?

GHSA-m462-mqw4-2c8m is a security advisory published by GitHub Security Advisories with Critical severity. Mattermost Server has X.509 Improper Certificate Validation

Which CVE IDs does GHSA-m462-mqw4-2c8m cover?

GHSA-m462-mqw4-2c8m covers the following CVE IDs: CVE-2017-18911. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m462-mqw4-2c8m?

GHSA-m462-mqw4-2c8m has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

Which products are affected by GHSA-m462-mqw4-2c8m?

GHSA-m462-mqw4-2c8m affects 3 products, including: go/github.com/mattermost/mattermost-server:\u003c 3.6.7-rc1; go/github.com/mattermost/mattermost-server:\u003e= 3.7.0, \u003c 3.7.5; go/github.com/mattermost/mattermost-server:\u003e= 3.8.0, \u003c 3.8.2.

GHSA-m462-mqw4-2c8mCriticalCVSS 9.1

Mattermost Server has X.509 Improper Certificate Validation

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

February 6, 2026

🔗 CVE IDs covered (1)

CVE-2017-18911 →

📋 Description

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server.

🎯 Affected products3

go/github.com/mattermost/mattermost-server:< 3.6.7-rc1
go/github.com/mattermost/mattermost-server:>= 3.7.0, < 3.7.5
go/github.com/mattermost/mattermost-server:>= 3.8.0, < 3.8.2

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2017-18911
https://github.com/mattermost/mattermost/commit/222bce0c5c1abb2f58c3a6de1fe8c5d3accffb21
https://github.com/mattermost/mattermost/commit/691c18157025d4808b5b11de1d6de01050e54fa6
https://github.com/mattermost/mattermost/commit/e9bb8cdfb4915067349a4840ab15ff941c4eb070
https://mattermost.com/security-updates
https://github.com/advisories/GHSA-m462-mqw4-2c8m