CVEvulnerability

CVE-2022-2366

5.3 MEDIUM Published 2022-07-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-07-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.6 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-276

Description

Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers.

Affected configurations

• mattermost mattermost server (< 6.3.9) • mattermost mattermost server (>= 6.4.0 < 6.5.2) • mattermost mattermost server (>= 6.6.0 < 6.6.2) • mattermost mattermost server 6.7.0

Related

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References