CVE-2022-1385

Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.
References
Link Resource
https://hackerone.com/reports/1486820 Exploit Third Party Advisory
https://mattermost.com/security-updates/ Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-04-19 21:15

Updated : 2024-02-28 19:09


NVD link : CVE-2022-1385

Mitre link : CVE-2022-1385

CVE.ORG link : CVE-2022-1385


JSON object : View

Products Affected

mattermost

  • mattermost_server
CWE
CWE-668

Exposure of Resource to Wrong Sphere

CWE-664

Improper Control of a Resource Through its Lifetime