CVE-2022-2401CWE-200

Team members could access sensitive information of other users via an API call

Medium · published July 14, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
57.1
In the wild
Unconfirmed
What it is

Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00828 · 57.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-07-14T17:20Z
EPSS history
Timeline
  • 14 JUL 17:20Z
    Team members could access sensitive information of other users via an API call
    cvelistv5