Skip to content
CVE PROGRAM SOURCE RECORD5.6 Medium

CVE-2022-2366

Incorrect defaults can cause attackers to bypass rate limitations

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mattermost

Description

Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost

  • 6.7.x 6.7.0affected
  • 6.x to ≤ 6.3.8affected
  • 6.5.x to ≤ 6.5.1affected
  • 6.6.x to ≤ 6.6.1affected

References