GHSA-fxwj-v664-wv5g

ghsaUSosv

Improper Control of a Resource Through its Lifetime in Mattermost

view advisory published 2022-04-20Licence: CC-BY-4.0

Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-1385US	medium4.6	0.84% (58th)	—	2022-04-19
Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to…

references

External citations — patches, advisories, analysis.

https://github.com/mattermost/mattermost-serverPACKAGE
https://hackerone.com/reports/1486820WEB
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2022-1385ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan