CVE-2022-0708CWE-200

Team Creator's Email Address is disclosed to Team Members via one of the APIs

Medium · published February 21, 2022

CVSS v3.1
4.3
EPSS
1%
Percentile
56.3
In the wild
Unconfirmed
What it is

Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information resulting in sensitive & private information disclosure.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00804 · 56.3th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-02-21T17:49Z
EPSS history
Timeline
  • 21 FEB 17:49Z
    Team Creator's Email Address is disclosed to Team Members via one of the APIs
    cvelistv5