PT-2022-13805 · Mattermost · Mattermost

Rohitesh Gupta · Published 2022-04-13 · Updated 2024-08-21 · CVE-2022-1332

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 6.4.1 and earlier

Description The issue is related to improper privilege management in Mattermost, where an API fails to properly protect permissions. This allows authenticated members with restricted custom admin roles to bypass restrictions and view sensitive information, including server logs and the contents of the server config.json file.

Recommendations For Mattermost versions 6.4.1 and earlier, update to version 6.4.2, 6.3.5, 6.2.5, or 5.37.9 to resolve the issue. As a temporary workaround, consider restricting access to the API endpoint responsible for permissions management until a patch is applied. Additionally, review and restrict custom admin roles to minimize the risk of exploitation.

Fix

Improper Privilege Management

Information Disclosure

Weakness Enumeration

CWE-269

CWE-200

Related Identifiers

BIT-MATTERMOST-2022-1332

CVE-2022-1332

GHSA-QGGC-PJ29-J27M

GO-2022-0616

Affected Products

Mattermost

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-1332 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qggc-pj29-j27m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1332 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mattermost-2022-1332 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0616 · Vendor Advisory
• https://github.com/mattermost/mattermost-server · Note
• https://github.com/advisories/GHSA-qggc-pj29-j27m · Note
• https://t.me/cvenotify/28870 · Telegram Post