CVE-2017-18920

CRITICAL

Mattermost Server <3.6.2 - SSRF

Title source: llm

Description

An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy.

References (1)

Scores

CVSS v3 9.8
EPSS 0.0050
EPSS Percentile 65.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Status published

Affected Products (1)

mattermost/mattermost_server < 3.6.2

Timeline

Published Jun 19, 2020
Tracked Since Feb 18, 2026