CVE-2022-1332: Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents
One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2022-1332?
CVE-2022-1332 is a vulnerability in Mattermost version 6.4.1 and earlier that allows authenticated members with restricted custom admin role to bypass restrictions and view server logs and config.json file contents.
What software versions are affected by CVE-2022-1332?
Mattermost versions 5.37.0 to 5.37.9, 6.2.0 to 6.2.5, 6.3.0 to 6.3.5, and 6.4.0 to 6.4.2 are affected by CVE-2022-1332.
How severe is CVE-2022-1332?
CVE-2022-1332 has a severity rating of 4.3 out of 10.
How can I fix CVE-2022-1332?
To fix CVE-2022-1332, it is recommended to upgrade to a patched version of Mattermost Server.
Where can I find more information about CVE-2022-1332?
You can find more information about CVE-2022-1332 on the Mattermost website at https://mattermost.com/security-updates/