CVE-2022-2366
Summary
| CVE | CVE-2022-2366 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-07-12 14:15:00 UTC |
| Updated | 2022-07-28 15:37:00 UTC |
| Description | Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers. |
Risk And Classification
Problem Types: CWE-276
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Mattermost | Mattermost Server | All | All | All | All |
| Application | Mattermost | Mattermost Server | 6.7.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Updates - Mattermost Open Source Collaboration Platform | MISC | mattermost.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Thanks to Adam Pritchard for contributing to this improvement under the Mattermost responsible disclosure policy.
There are currently no legacy QID mappings associated with this CVE.