{"id":"CVE-2022-1385","state":"PUBLISHED","title":"Invitation Email is resent as a Reminder after invalidating pending email invites","description":"Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.","publishedAt":"2022-04-19T20:26:27.000Z","updatedAt":"2024-12-06T23:09:33.235Z","severity":{"score":3.7,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","source":"Mattermost"},"assigner":"Mattermost","products":["Mattermost Mattermost"],"affected":[{"vendor":"Mattermost","product":"Mattermost","versions":[{"version":"unspecified","status":"affected","lessThan":"6.5.0","versionType":"custom"}]}],"references":["https://mattermost.com/security-updates/","https://hackerone.com/reports/1486820"],"weaknesses":["CWE-664"],"ingestedAt":"2026-10-29T19:49:29.138Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/1xxx/CVE-2022-1385.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-1385","state":"PUBLISHED","datePublished":"2022-04-19T20:26:27.000Z","dateUpdated":"2024-12-06T23:09:33.235Z","assignerShortName":"Mattermost","assignerOrgId":"9302f53e-dde5-4bf3-b2f2-a83f91ac0eee","dateReserved":"2022-04-18T00:00:00.000Z"},"containers":{"cna":{"title":"Invitation Email is resent as a Reminder after invalidating pending email invites","descriptions":[{"lang":"en","value":"Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels."}],"affected":[{"vendor":"Mattermost","product":"Mattermost","versions":[{"version":"unspecified","status":"affected","lessThan":"6.5.0","versionType":"custom"}]}],"references":[{"url":"https://mattermost.com/security-updates/","tags":["x_refsource_MISC"]},{"url":"https://hackerone.com/reports/1486820","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-664","description":"CWE-664 Improper Control of a Resource Through its Lifetime","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Mattermost","dateUpdated":"2022-04-19T20:26:27.000Z","orgId":"9302f53e-dde5-4bf3-b2f2-a83f91ac0eee"},"credits":[{"lang":"en","value":"Thanks to mr_anon (mr_anksec) for contributing to this improvement under the Mattermost responsible disclosure policy."}],"solutions":[{"lang":"en","value":"Update Mattermost to version v6.5 or higher"}],"source":{"advisory":"MMSA-2022-0092","defect":["https://mattermost.atlassian.net/browse/MM-42026"],"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"responsibledisclosure@mattermost.com","ID":"CVE-2022-1385","STATE":"PUBLIC","TITLE":"Invitation Email is resent as a Reminder after invalidating pending email invites"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Mattermost","version":{"version_data":[{"version_affected":"<","version_value":"6.5.0"}]}}]},"vendor_name":"Mattermost"}]}},"credit":[{"lang":"eng","value":"Thanks to mr_anon (mr_anksec) for contributing to this improvement under the Mattermost responsible disclosure policy."}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-664 Improper Control of a Resource Through its Lifetime"}]}]},"references":{"reference_data":[{"name":"https://mattermost.com/security-updates/","refsource":"MISC","url":"https://mattermost.com/security-updates/"},{"name":"https://hackerone.com/reports/1486820","refsource":"MISC","url":"https://hackerone.com/reports/1486820"}]},"solution":[{"lang":"en","value":"Update Mattermost to version v6.5 or higher"}],"source":{"advisory":"MMSA-2022-0092","defect":["https://mattermost.atlassian.net/browse/MM-42026"],"discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://mattermost.com/security-updates/","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://hackerone.com/reports/1486820","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T00:03:06.033Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-12-06T22:53:01.351181Z","id":"CVE-2022-1385","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-12-06T23:09:33.235Z"}}]}}}