CVE-2022-2401: Team members could access sensitive information of other users via an API call
Published Jul 14, 2022
·Updated
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
Affected Software
5 affected components
Mattermost Mattermost Server<6.3.9
Mattermost Mattermost Server>=6.4.0<6.5.2
Mattermost Mattermost Server=6.6.0
Mattermost Mattermost Server=6.6.1
Mattermost Mattermost Server=6.7.0
Remediation
Information
Update Mattermost to version v7.0.0, 6.7.1, 6.6.2, 6.5.2, 6.3.9 or higher.
Event History
Jul 14, 2022
CVE Published
via MITRE·05:20 PM
Data Sourced
via MITRE·05:20 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for the unrestricted information disclosure in Mattermost?
The vulnerability ID for the unrestricted information disclosure in Mattermost is CVE-2022-2401.
2
What is the severity level of CVE-2022-2401?
The severity level of CVE-2022-2401 is medium with a score of 6.5.
3
Which version of Mattermost is affected by CVE-2022-2401?
Mattermost version 6.7.0 and earlier is affected by CVE-2022-2401.
4
How can team members access sensitive information through CVE-2022-2401?
Team members can access sensitive information through CVE-2022-2401 by directly accessing the APIs.
5
How can I fix the unrestricted information disclosure vulnerability in Mattermost?
To fix the unrestricted information disclosure vulnerability in Mattermost, it is recommended to update to the latest version of Mattermost that includes the security patch.