CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2022-2401
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mattermost:mattermost_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7ggc-5r84-xf54 | Go | github.com/mattermost/mattermost-server/v6 | <6.3.9 | 6.3.9 |
| GHSA-7ggc-5r84-xf54 | Go | github.com/mattermost/mattermost-server/v6 | >=6.4.0 <6.5.2 | 6.5.2 |
| GHSA-7ggc-5r84-xf54 | Go | github.com/mattermost/mattermost-server/v6 | >=6.6.0 <6.6.2 | 6.6.2 |
| GHSA-7ggc-5r84-xf54 | Go | github.com/mattermost/mattermost-server/v6 | >=6.7.0 <6.7.1 | 6.7.1 |
| GO-2022-0540 | Go | github.com/mattermost/mattermost-server | all versions | no fix published |
| GO-2022-0540 | Go | github.com/mattermost/mattermost-server/v5 | all versions | no fix published |
| GO-2022-0540 | Go | github.com/mattermost/mattermost-server/v6 | <6.3.9 >=6.4.0 <6.5.2 >=6.6.0 <6.6.2 >=6.7.0 <6.7.1 | 6.3.9, 6.5.2, 6.6.2, 6.7.1 |