cve.bz

CVE-2022-1384

8.8 highEPSS 0.7%

High (8.8) in mattermost mattermost server. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost-server/v6 6.5.0.

Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities.

Severity

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
CWEs
CWE-862, CWE-477
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-32rp-q37p-jg6wGogithub.com/mattermost/mattermost-server/v6>=6.4.0 <6.5.06.5.0
GO-2022-0576Gogithub.com/mattermost/mattermost-serverall versionsno fix published
GO-2022-0576Gogithub.com/mattermost/mattermost-server/v5all versionsno fix published
GO-2022-0576Gogithub.com/mattermost/mattermost-server/v6>=6.4.0 <6.5.06.5.0

References

Check your stackJSON