What is GHSA-r6j5-fqx9-7qv9?

GHSA-r6j5-fqx9-7qv9 is a security advisory published by GitHub Security Advisories with High severity. Mattermost Server SAML implementation does not require encryption or signature verification as default

Which CVE IDs does GHSA-r6j5-fqx9-7qv9 cover?

GHSA-r6j5-fqx9-7qv9 covers the following CVE IDs: CVE-2017-18909. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r6j5-fqx9-7qv9?

GHSA-r6j5-fqx9-7qv9 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-r6j5-fqx9-7qv9?

GHSA-r6j5-fqx9-7qv9 affects 1 product, including: go/github.com/mattermost/mattermost-server:\u003c 3.8.1-0.20170504181128-4f074fed0d65.

GHSA-r6j5-fqx9-7qv9HighCVSS 7.5

Mattermost Server SAML implementation does not require encryption or signature verification as default

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

February 10, 2026

🔗 CVE IDs covered (1)

CVE-2017-18909 →

📋 Description

An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory.

🎯 Affected products1

go/github.com/mattermost/mattermost-server:< 3.8.1-0.20170504181128-4f074fed0d65

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2017-18909
https://github.com/mattermost/mattermost/commit/4f074fed0d653a28779ac586e418341232d43e95
https://mattermost.com/security-updates
https://github.com/advisories/GHSA-r6j5-fqx9-7qv9