CVE-2022-1002
Summary
| CVE | CVE-2022-1002 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-03-18 18:15:00 UTC |
| Updated | 2022-03-29 14:53:00 UTC |
| Description | Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with special permissions to invite guest users to inject unescaped HTML content in the email invitations. |
Risk And Classification
Problem Types: CWE-79
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Mattermost | Mattermost | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| HackerOne | MISC | hackerone.com | |
| Security Updates - Mattermost Open Source Collaboration Platform | MISC | mattermost.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Thanks to Imamul Mursalin for contributing to this improvement under the Mattermost responsible disclosure policy.
There are currently no legacy QID mappings associated with this CVE.