CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2022-1332
Medium (4.3) in mattermost mattermost server. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost-server/v6 6.2.5, 6.3.5, 6.4.2.
One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-269, CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mattermost:mattermost_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qggc-pj29-j27m | Go | github.com/mattermost/mattermost-server/v6 | >=6.4.0 <6.4.2 | 6.4.2 |
| GHSA-qggc-pj29-j27m | Go | github.com/mattermost/mattermost-server/v6 | >=6.3.0 <6.3.5 | 6.3.5 |
| GHSA-qggc-pj29-j27m | Go | github.com/mattermost/mattermost-server/v6 | >=6.0.0 <6.2.5 | 6.2.5 |
| GHSA-qggc-pj29-j27m | Go | github.com/mattermost/mattermost-server/v5 | <5.37.9 | 5.37.9 |
| GO-2022-0616 | Go | github.com/mattermost/mattermost-server | all versions | no fix published |
| GO-2022-0616 | Go | github.com/mattermost/mattermost-server/v5 | <5.37.9 | 5.37.9 |
| GO-2022-0616 | Go | github.com/mattermost/mattermost-server/v6 | >=6.0.0 <6.2.5 >=6.3.0 <6.3.5 >=6.4.0 <6.4.2 | 6.2.5, 6.3.5, 6.4.2 |