CVE-2022-1385

Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.
References
Link Resource
https://hackerone.com/reports/1486820 Exploit Third Party Advisory
https://mattermost.com/security-updates/ Vendor Advisory
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*

Information

Published : 2022-04-19 14:15

Updated : 2022-04-27 14:19


NVD link : CVE-2022-1385

Mitre link : CVE-2022-1385


JSON object : View

CWE
CWE-668

Exposure of Resource to Wrong Sphere

Advertisement

dedicated server usa

Products Affected

mattermost

  • mattermost_server