What is CVE-2022-1332?

CVE-2022-1332 is a medium-severity vulnerability in Mattermost, classified under Information Disclosure. CVSS score: 4.3/10. Published 2022-04-13.

How severe is CVE-2022-1332?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Privilege escalation in Mattermost

CVE-2022-1332

One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents.

Vulnerability class: Information Disclosure

EPSS: 0.006 (46.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Mattermost — versions 6.4, 6.3, 6.2
Mattermost Mattermost_server

Weakness classification (CWE)

References

responsibledisclosure@mattermost.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2022-1332?: CVE-2022-1332 is a medium-severity vulnerability in Mattermost, classified under Information Disclosure. CVSS score: 4.3/10. Published 2022-04-13.
How severe is CVE-2022-1332?: Medium severity. CVSS v3 base score is 4.3 out of 10.