Skip to content
OpenAdvisories
Medium · 6.5 CVE-2022-2401 BIT-mattermost-2022-2401EUVD-2022-6283GHSA-7ggc-5r84-xf54GO-2022-0540

Team members could access sensitive information of other users via an API call

Published Jul 14, 2022 · Updated Dec 6, 2024 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost Package: github.com/mattermost/mattermost-server Package: github.com/mattermost/mattermost-server/v5 Package: github.com/mattermost/mattermost-server/v6 Ecosystem: Go

Description

Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.

Affected products

VendorProductAffectedFixed
Mattermost Mattermost 6.7.x 6.7.0, 6.x – ≤ 6.3.8, 6.5.x – ≤ 6.5.1, 6.6.x – ≤ 6.6.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mattermost/mattermost-server all versions — GO-2022-0540
Go github.com/mattermost/mattermost-server/v5 all versions — GO-2022-0540
Go github.com/mattermost/mattermost-server/v6 < 6.3.9 6.3.9 GHSA-7ggc-5r84-xf54
Go github.com/mattermost/mattermost-server/v6 >= 6.4.0, < 6.5.2 6.5.2 GHSA-7ggc-5r84-xf54
Go github.com/mattermost/mattermost-server/v6 >= 6.6.0, < 6.6.2 6.6.2 GHSA-7ggc-5r84-xf54
Go github.com/mattermost/mattermost-server/v6 >= 6.7.0, < 6.7.1 6.7.1 GHSA-7ggc-5r84-xf54
Go github.com/mattermost/mattermost-server/v6 < 6.3.9 · >= 6.4.0, < 6.5.2 · >= 6.6.0, < 6.6.2 · >= 6.7.0, < 6.7.1 6.3.9, 6.5.2, 6.6.2, 6.7.1 GO-2022-0540

References