{"api_version":"1","generated_at":"2026-07-23T10:07:40+00:00","cve":"CVE-2022-0708","urls":{"html":"https://cve.report/CVE-2022-0708","api":"https://cve.report/api/cve/CVE-2022-0708.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-0708","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-0708"},"summary":{"title":"CVE-2022-0708","description":"Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information resulting in sensitive & private information disclosure.","state":"PUBLIC","assigner":"responsibledisclosure@mattermost.com","published_at":"2022-02-21 18:15:00","updated_at":"2022-03-01 15:45:00"},"problem_types":["CWE-200"],"metrics":[],"references":[{"url":"https://mattermost.com/security-updates/","name":"https://mattermost.com/security-updates/","refsource":"MISC","tags":[],"title":"Security Updates - Mattermost Open Source Collaboration Platform","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0708","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0708","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"708","vulnerable":"1","versionEndIncluding":"6.3.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mattermost","cpe5":"mattermost","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"responsibledisclosure@mattermost.com","ID":"CVE-2022-0708","STATE":"PUBLIC","TITLE":"Team Creator's Email Address is disclosed to Team Members via one of the APIs"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Mattermost","version":{"version_data":[{"version_affected":"<=","version_value":"6.3.0"},{"version_affected":"!>=","version_value":"6.2.2"},{"version_affected":"!>=","version_value":"6.1.2"},{"version_affected":"!>=","version_value":"5.37.7"}]}}]},"vendor_name":"Mattermost "}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information resulting in sensitive & private information disclosure."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-200 Information Exposure"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://mattermost.com/security-updates/","name":"https://mattermost.com/security-updates/"}]},"source":{"advisory":"MMSA-2022-0082","defect":["https://mattermost.atlassian.net/browse/MM-40177"],"discovery":"EXTERNAL"}},"nvd":{"publishedDate":"2022-02-21 18:15:00","lastModifiedDate":"2022-03-01 15:45:00","problem_types":["CWE-200"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*","versionEndIncluding":"6.3.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}