CVE-2022-1384CWE-477

Authorized users are allowed to install old plugin versions from the Marketplace

Medium · published April 19, 2022

CVSS v3.1
4.7
EPSS
1%
Percentile
51.6
In the wild
Unconfirmed
What it is

Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00675 · 51.6th percentile
Weakness
CWE-477 · Use of Obsolete Function
Published
2022-04-19T20:26Z
EPSS history
Timeline
  • 19 APR 20:26Z
    Authorized users are allowed to install old plugin versions from the Marketplace
    cvelistv5