PT-2022-16456 · Mattermost · Mattermost

Rohit Kc · Published 2022-07-14 · Updated 2023-06-30 · CVE-2022-2408

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 6.7.0 and earlier

Description The Guest account feature fails to properly restrict permissions, allowing a guest user to fetch a list of all public channels in the team, even if they are not part of those channels.

Recommendations For Mattermost versions 6.7.0 and earlier, consider disabling the Guest account feature until a patch is available to properly restrict permissions and prevent unauthorized access to public channels.

Fix

Incorrect Authorization

Information Disclosure

Weakness Enumeration

CWE-863

CWE-200

Related Identifiers

CVE-2022-2408

Affected Products

Mattermost

References · 6

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2408 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2408 · Security Note
• https://t.me/cvenotify/33083 · Telegram Post
• https://t.me/cvenotify/53428 · Telegram Post
• https://t.me/cibsecurity/46270 · Telegram Post