CVE-2022-1385 - Invitation Email is resent as a Reminder after invalidating pending email invites

Back Back to CVE browser

MEDIUM

Invitation Email is resent as a Reminder after invalidating pending email invites

Published Apr 19, 2022

4.6

MEDIUM

CVSS 3.1

EPSS 0.84%

Description

Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.

Affected products

Vendor Mattermost Product Mattermost Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <6.5.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mattermost

n/a

Version	Status	Constraints
unspecified	affected	<6.5.0

github.com/mattermost/mattermost-server/v6

Go

Introduced 0 Fixed 6.5.0
github.com/mattermost/mattermost-server

Go

Introduced 0 Fixed not fixed
github.com/mattermost/mattermost-server/v5

Go

Introduced 0 Fixed not fixed

Ecosystem	Package	Fixed
Go	github.com/mattermost/mattermost-server/v6	6.5.0
Go	github.com/mattermost/mattermost-server	not fixed
Go	github.com/mattermost/mattermost-server/v5	not fixed

Remediation

Vendor solution

Update Mattermost to version v6.5 or higher

Weaknesses (2)

CWE-664

CWE-668

References (4)

https://github.com/advisories/GHSA-fxwj-v664-wv5g
Advisory
https://hackerone.com/reports/1486820
x_refsource_MISCExploitThird Party Advisory
https://mattermost.com/security-updates/
x_refsource_MISCVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-1385

Link	Providers	Tags
https://github.com/advisories/GHSA-fxwj-v664-wv5g		Advisory
https://hackerone.com/reports/1486820		x_refsource_MISCExploitThird Party Advisory
https://mattermost.com/security-updates/		x_refsource_MISCVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-1385