CVE-2022-1332CWE-200

Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents

Medium · published April 13, 2022

CVSS v3.1
4.3
EPSS
1%
Percentile
50.5
In the wild
Unconfirmed
What it is

One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00650 · 50.5th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-04-13T17:06Z
EPSS history
Timeline
  • 13 APR 17:06Z
    Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents
    cvelistv5