CVE-2022-1385
published 2022-04-19CVE-2022-1385: Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows…
PriorityP422medium4.6CVSS 3.1
AVNACLPRLUIRSUCLILAN
EPSS
0.83%
53.8th percentile
Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server_v6 | >= 0 < 6.5.0 | 6.5.0 |
| mattermost | mattermost | >= unspecified < 6.5.0 | 6.5.0 |
| mattermost | mattermost_server | < 6.5.0 | 6.5.0 |
CVSS provenance
nvdv3.14.6MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
cisa7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Improper Control of a Resource Through its Lifetime in Mattermost in github.com/mattermost/mattermost-server
osv·2024-08-21
CVE-2022-1385 Improper Control of a Resource Through its Lifetime in Mattermost in github.com/mattermost/mattermost-server
Improper Control of a Resource Through its Lifetime in Mattermost in github.com/mattermost/mattermost-server
Improper Control of a Resource Through its Lifetime in Mattermost in github.com/mattermost/mattermost-server
GHSA
Improper Control of a Resource Through its Lifetime in Mattermost
ghsa·2022-04-20
CVE-2022-1385 [MEDIUM] CWE-664 Improper Control of a Resource Through its Lifetime in Mattermost
Improper Control of a Resource Through its Lifetime in Mattermost
Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.
OSV
Improper Control of a Resource Through its Lifetime in Mattermost
osv·2022-04-20
CVE-2022-1385 [MEDIUM] Improper Control of a Resource Through its Lifetime in Mattermost
Improper Control of a Resource Through its Lifetime in Mattermost
Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.
CISA
Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability
cisa·2022-05-23·CVSS 7.8
CVE-2019-1385 [HIGH] CWE-59 Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability
Vulnerability: Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability
Affected: Microsoft Windows
A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2019-1385
Remediation Due Date: 2022-06-13
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-04-19
Published