CVE-2022-1385

Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.
References
Link Resource
https://hackerone.com/reports/1486820 Exploit Third Party Advisory
https://mattermost.com/security-updates/ Vendor Advisory
https://hackerone.com/reports/1486820 Exploit Third Party Advisory
https://mattermost.com/security-updates/ Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:40

Type Values Removed Values Added
References () https://hackerone.com/reports/1486820 - Exploit, Third Party Advisory () https://hackerone.com/reports/1486820 - Exploit, Third Party Advisory
References () https://mattermost.com/security-updates/ - Vendor Advisory () https://mattermost.com/security-updates/ - Vendor Advisory
CVSS v2 : 5.8
v3 : 4.6
v2 : 5.8
v3 : 3.7

Information

Published : 2022-04-19 21:15

Updated : 2024-11-21 06:40


NVD link : CVE-2022-1385

Mitre link : CVE-2022-1385

CVE.ORG link : CVE-2022-1385


JSON object : View

Products Affected

mattermost

  • mattermost_server
CWE
CWE-664

Improper Control of a Resource Through its Lifetime

CWE-668

Exposure of Resource to Wrong Sphere