Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2022-2401

Team members could access sensitive information of other users via an API call

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mattermost

Description

Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost

  • 6.7.x 6.7.0affected
  • 6.x to ≤ 6.3.8affected
  • 6.5.x to ≤ 6.5.1affected
  • 6.6.x to ≤ 6.6.1affected

References