CVE-2022-2366CWE-276

Incorrect defaults can cause attackers to bypass rate limitations

Medium · published July 11, 2022

CVSS v3.1
5.6
EPSS
1%
Percentile
50.2
In the wild
Unconfirmed
What it is

Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers.

The record
Technical detail
CVSS v3.1
5.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00643 · 50.2th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2022-07-11T14:08Z
EPSS history
Timeline
  • 11 JUL 14:08Z
    Incorrect defaults can cause attackers to bypass rate limitations
    cvelistv5