CVE-2022-2366 MEDIUM

CVE-2022-2366: Incorrect defaults can cause attackers to bypass rate limitations

Vendor Mattermost
Product Mattermost
Weakness CWE-276
Published July 11, 2022
Last update December 6, 2024
View on NVD All CVEs

CVSS base score

5.6/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers.

Key dates

02Disclosure timeline

July 11, 2022 CVE published
December 6, 2024 Record updated