Vulnerability · Published Apr 19, 2022 · Assigned by Mattermost
CVE-2022-1385Invitation Email is resent as a Reminder after invalidating pending email invites
Low 3.7
In plain English
A low-severity security flaw in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.8%top 41.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | no fix listed | GO-2022-0599 |
| Go | github.com/mattermost/mattermost-server/v5 | no fix listed | GO-2022-0599 |
| Go | github.com/mattermost/mattermost-server/v6 | 6.5.0 | GHSA-fxwj-v664-wv5g |
| Go | github.com/mattermost/mattermost-server/v6 | 6.5.0 | GO-2022-0599 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | unspecified – before 6.5.0 |
Weakness: CWE-664 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
- https://mattermost.com/security-updates/ x_refsource_MISC
- https://hackerone.com/reports/1486820 x_refsource_MISC