CVE-2022-2366 — Incorrect Default Permissions in Server

CWE-276 — Incorrect Default Permissions3 documents3 sources
Severity
5.3MEDIUMNVD
CNA5.6
EPSS
0.2%
top 59.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mattermost ServerMattermost
Timeline
PublishedJul 12
Latest updateJul 13

Description

Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDmattermost/mattermost_server6.4.0 — 6.5.2+3
▶CVEListV5mattermost/mattermost6.x — 6.3.8+3

🔴Vulnerability Details

2
GHSA
GHSA-8xxp-2g7w-ph6m: Incorrect default configuration for trusted IP header in Mattermost version 6↗2022-07-13
▶
CVEList
Incorrect defaults can cause attackers to bypass rate limitations↗2022-07-11
▶
CVE-2022-2366 — Incorrect Default Permissions in Server | cvebase