CVE-2022-1385CWE-664

Invitation Email is resent as a Reminder after invalidating pending email invites

Low · published April 19, 2022

CVSS v3.1
3.7
EPSS
1%
Percentile
57.5
In the wild
Unconfirmed
What it is

Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00843 · 57.5th percentile
Weakness
CWE-664 · Improper Control of a Resource Through its Lifetime
Published
2022-04-19T20:26Z
EPSS history
Timeline
  • 19 APR 20:26Z
    Invitation Email is resent as a Reminder after invalidating pending email invites
    cvelistv5