PT-2022-13846 · Mattermost · Mattermost

Mr_Anksec + 1 · Published 2022-04-19 · Updated 2024-08-21 · CVE-2022-1385

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 6.4.x and earlier

Description The issue arises from the failure to properly invalidate pending email invitations when the action is performed from the system console. This allows accidentally invited users to join the workspace and access information from public teams and channels. The problem is related to improper control of a resource through its lifetime in Mattermost.

Recommendations For Mattermost versions 6.4.x and earlier, consider restricting access to public teams and channels until a proper fix is applied to prevent accidentally invited users from accessing sensitive information. As a temporary workaround, manually invalidate pending email invitations to prevent unauthorized access.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-664

CWE-668

Related Identifiers

BIT-MATTERMOST-2022-1385

CVE-2022-1385

GHSA-FXWJ-V664-WV5G

GO-2022-0599

Affected Products

Mattermost

References · 9

• 🔥 https://hackerone.com/reports/1486820 · Exploit
• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1385 · Security Note
• https://osv.dev/vulnerability/GHSA-fxwj-v664-wv5g · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0599 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mattermost-2022-1385 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1385 · Vendor Advisory
• https://github.com/mattermost/mattermost-server · Note
• https://github.com/advisories/GHSA-fxwj-v664-wv5g · Note