CVE-2022-1332
published 2022-04-13CVE-2022-1332: One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.63%
46.3th percentile
One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server_v5 | >= 0 < 5.37.9 | 5.37.9 |
| github.com | mattermost_mattermost-server_v6 | >= 6.0.0 < 6.2.5 | 6.2.5 |
| github.com | mattermost_mattermost-server_v6 | >= 6.3.0 < 6.3.5 | 6.3.5 |
| github.com | mattermost_mattermost-server_v6 | >= 6.4.0 < 6.4.2 | 6.4.2 |
| mattermost | mattermost | >= 5.37 < 5.37.9 | 5.37.9 |
| mattermost | mattermost | >= 6.2 < 6.2.5 | 6.2.5 |
| mattermost | mattermost | >= 6.3 < 6.3.5 | 6.3.5 |
| mattermost | mattermost | >= 6.4 < 6.4.2 | 6.4.2 |
| mattermost | mattermost_server | >= 5.37.0 < 5.37.9 | 5.37.9 |
| mattermost | mattermost_server | >= 6.2.0 < 6.2.5 | 6.2.5 |
| mattermost | mattermost_server | >= 6.3.0 < 6.3.5 | 6.3.5 |
| mattermost | mattermost_server | >= 6.4.0 < 6.4.2 | 6.4.2 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Improper Privilege Management in Mattermost in github.com/mattermost/mattermost-server
osv·2024-08-21
CVE-2022-1332 Improper Privilege Management in Mattermost in github.com/mattermost/mattermost-server
Improper Privilege Management in Mattermost in github.com/mattermost/mattermost-server
Improper Privilege Management in Mattermost in github.com/mattermost/mattermost-server
GHSA
Improper Privilege Management in Mattermost
ghsa·2022-04-14
CVE-2022-1332 [MEDIUM] CWE-200 Improper Privilege Management in Mattermost
Improper Privilege Management in Mattermost
One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents. Per the Mattermost security updates page, versions 6.4.2, 6.3.5, 6.2.5, and 5.37.9 contain patches for this issue
OSV
Improper Privilege Management in Mattermost
osv·2022-04-14
CVE-2022-1332 [MEDIUM] Improper Privilege Management in Mattermost
Improper Privilege Management in Mattermost
One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents. Per the Mattermost security updates page, versions 6.4.2, 6.3.5, 6.2.5, and 5.37.9 contain patches for this issue
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-04-13
Published