PT-2022-16410 · Mattermost · Mattermost

Elias Nahum · Published 2022-07-14 · Updated 2024-08-21 · CVE-2022-2401

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 6.7.0 and earlier

Description The issue allows team members to access some sensitive information by directly accessing the APIs. This is an unrestricted information disclosure issue that affects all users.

Recommendations For Mattermost versions 6.7.0 and earlier, consider restricting access to sensitive APIs to minimize the risk of exploitation. As a temporary workaround, limit the ability of team members to directly access APIs that may disclose sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-MATTERMOST-2022-2401

CVE-2022-2401

GHSA-7GGC-5R84-XF54

GO-2022-0540

Affected Products

Mattermost

References · 10

• https://osv.dev/vulnerability/BIT-mattermost-2022-2401 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2401 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7ggc-5r84-xf54 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2401 · Security Note
• https://osv.dev/vulnerability/GO-2022-0540 · Vendor Advisory
• https://github.com/mattermost/mattermost-server · Note
• https://t.me/cibsecurity/46276 · Telegram Post
• https://t.me/cvenotify/33085 · Telegram Post
• https://github.com/advisories/GHSA-7ggc-5r84-xf54 · Note