UpHeron
All vulnerabilities

Servers and applications

CVE-2022-1332

One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents.

Severity
Medium 4.3
Published
13 Apr 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
5.37.9, 6.2.5, 6.3.5, 6.4.2
Sources
NVD

Affected software

SoftwareAffected versions
MattermostServers and applications · cpe:a:mattermost:mattermost_server
  • From 5.37.0 before 5.37.9
  • From 6.2.0 before 6.2.5
  • From 6.3.0 before 6.3.5
  • From 6.4.0 before 6.4.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-1332
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-1332