CVE-2022-1385 LOW

CVE-2022-1385: Invitation Email is resent as a Reminder after invalidating pending email invites

Vendor Mattermost

Product Mattermost

Weakness CWE-664

Published April 19, 2022

Last update December 6, 2024

View on NVD All CVEs

CVSS base score

3.7/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.

Key dates

02Disclosure timeline

April 19, 2022 CVE published

December 6, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-1385 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/664.html

Related vulnerabilities

04Related CVE

CVE-2019-16779 In RubyGem excon, interrupted Persistent Connections May Leak Response Data CVE-2020-1620 Junos OS Evolved: Configd leaks hashes via log file and is world readable CVE-2022-22249 Junos OS: MX Series: An FPC crash might be seen due to mac-moves within the same bridge domain CVE-2022-20856 Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Mobility Denial of Service Vulnerability CVE-2023-44288