Unrated

Guest accounts can list all public channels

CVE-2022-2408 First seen on SecPulse Jul 15, 2022

Original description The description as published by the source.

The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

advisory github.com
advisory nvd.nist.gov
web mattermost.com

Key facts

Severity: Unrated
Published: Jul 15, 2022
First seen on SecPulse: Jul 15, 2022
CWE: CWE-200

NVD OSV

Detection sources

OSV.dev (Open Source Vulnerabilities)Oct 20, 20:00