« Volver al listado

CVE-2022-2401

Estado: ModificadaMedia (6.5)—

Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mattermost — Mattermost Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-2401",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-2401",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-06T22:52:47.302845Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "responsibledisclosure@mattermost.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "responsibledisclosure@mattermost.com",
      "affectedData": [
        {
          "vendor": "Mattermost",
          "product": "Mattermost",
          "versions": [
            {
              "status": "affected",
              "version": "6.7.x 6.7.0"
            },
            {
              "status": "affected",
              "version": "6.x",
              "versionType": "custom",
              "lessThanOrEqual": "6.3.8"
            },
            {
              "status": "affected",
              "version": "6.5.x",
              "versionType": "custom",
              "lessThanOrEqual": "6.5.1"
            },
            {
              "status": "affected",
              "version": "6.6.x",
              "versionType": "custom",
              "lessThanOrEqual": "6.6.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-07-14T18:15:08.313",
  "references": [
    {
      "url": "https://mattermost.com/security-updates/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "responsibledisclosure@mattermost.com"
    },
    {
      "url": "https://mattermost.com/security-updates/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "responsibledisclosure@mattermost.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs."
    },
    {
      "lang": "es",
      "value": "Una divulgación de información sin restricciones de todos los usuarios en Mattermost versiones 6.7.0 y anteriores, permite a miembros del equipo acceder a determinada información confidencial mediante el acceso directo a las API"
    }
  ],
  "lastModified": "2026-06-17T04:41:49.670",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D311744-6A53-4DD9-BE49-46E72BE1FB32",
              "versionEndExcluding": "6.3.9"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06ABE3B1-53EA-42AB-B986-E5A660677075",
              "versionEndExcluding": "6.5.2",
              "versionStartIncluding": "6.4.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:6.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5144C178-AA3E-43CC-80E2-77BC8689FE7A"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:6.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "667E1ED7-7A47-4021-A158-23425C9F6E2D"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:6.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13763CA7-57C3-4EBE-96D6-C244B5FE2704"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "responsibledisclosure@mattermost.com"
}