CVE-2021-37867CWE-200

Emails of all users are exposed via one of the Boards APIs

Medium · published January 18, 2022

CVSS v3.1
4.3
EPSS
1%
Percentile
51.5
In the wild
Unconfirmed
What it is

Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive & private information disclosure.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00672 · 51.5th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-01-18T16:52Z
EPSS history
Timeline
  • 18 JAN 16:52Z
    Emails of all users are exposed via one of the Boards APIs
    cvelistv5