GitHub Advisoryadvisory · Go

GHSA-fxwj-v664-wv5g Improper Control of a Resource Through its Lifetime in Mattermost

MEDIUM Published 2022-04-20 Modified 2022-04-28 Official page ↗
Aliases
CVE-2022-1385
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server/v6
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-664, CWE-668
Reviewed
2022-04-22

Affected packages

• Go github.com/mattermost/mattermost-server/v6: < 6.5.0 → fixed in 6.5.0

Description

Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.

Related

Alias · CVE (1)

  • CVE-2022-1385 Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console,… vulnerability

Weakness · CWE (2)

  • CWE-664 Improper Control of a Resource Through its Lifetime weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References