BIT-mattermost-2022-1384

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/mattermost/BIT-mattermost-2022-1384.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-mattermost-2022-1384

Aliases

Published

2024-03-06T11:04:07.589Z

Modified

2025-04-03T14:40:37.652Z

Summary

[none]

Details

Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities.

Database specific

{
    "cpes": [
        "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}

References

Affected packages

Bitnami / mattermost

Package

Name: mattermost
Purl: pkg:bitnami/mattermost

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.5.0

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/mattermost/BIT-mattermost-2022-1384.json"