PT-2021-21894 · Mattermost · Mattermost

At11Zt00 · Published 2021-12-17 · Updated 2024-03-06 · CVE-2021-37862

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Mattermost versions 6.0 and earlier

Description: The issue is related to insufficient validation of email addresses during the registration process. This allows attackers to trick users into signing up with attacker-controlled email addresses by using crafted invitation tokens.

Recommendations: For versions 6.0 and earlier, consider temporarily restricting the use of invitation tokens until a proper validation mechanism is implemented to prevent the exploitation of this issue. As a mitigation measure, closely monitor user registration activities to detect potential abuse. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BIT-MATTERMOST-2021-37862

CVE-2021-37862

Affected Products

Mattermost

References · 6

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37862 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37862 · Security Note
• https://osv.dev/vulnerability/BIT-mattermost-2021-37862 · Vendor Advisory
• https://t.me/cibsecurity/34202 · Telegram Post
• https://hackerone.com/reports/1357013 · Note