← CVE Intelligence

CVE-2022-2408

Guest accounts can list all public channels PUBLISHED

Description (CNA)

The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels.

Affected (CNA)

Vendor / productVersions
Mattermost / Mattermostaffected unspecified through 6.3.8; affected 6.4.x; affected 6.7.x 6.7.0; affected 6.5.x through 6.5.1; affected 6.6.x through 6.6.1

CWE

CWE-200

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.