CVE-2022-1385
EUVD-2022-173019.04.2022, 21:15
Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| mattermost | mattermost_server | 𝑥 < 6.5.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-664 - Improper Control of a Resource Through its LifetimeThe software does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
- CWE-668 - Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.