CVE-2022-1548

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-1548
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-1548.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-1548
Published
2022-05-03T20:11:21Z
Modified
2026-07-15T01:48:55.901795735Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Playbook members are allowed to escalate their membership privileges and perform actions restricted to playbook admins.
Details

Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook members to escalate their membership privileges and perform actions restricted to playbook admins.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "Playbooks"
                },
                {
                    "last_affected": "1.25"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-264"
    ],
    "cna_assigner": "Mattermost",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1548.json"
}
References

Affected packages

Git / github.com/mattermost/mattermost-plugin-playbooks

Affected ranges

Type
GIT
Repo
https://github.com/mattermost/mattermost-plugin-playbooks
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
23f84e01ca70b83ab980b8966689211a17ee58df
Database specific 
{
    "cpe": "cpe:2.3:a:mattermost:playbooks:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.25.0"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

client/v0.*
client/v0.1.0
client/v0.1.1
client/v0.2.0
client/v0.3.0
client/v0.4.0
client/v0.5.0
client/v0.6.0
client/v0.7.0
v0.*
v0.1.0
v0.2.0
v0.2.1
v0.2.2
v0.3.0
v0.3.1
v0.4.0
v0.4.0-alpha.1
v0.4.0-alpha.2
v0.4.0-alpha.3
v0.4.0-alpha.4
v0.4.0-alpha.5
v0.5.0
v0.5.0-alpha.1
v0.5.0-alpha.2
v0.5.0-alpha.3
v0.5.0-alpha.4
v0.5.0-alpha.5
v0.5.0-alpha.6
v0.6.0
v0.6.0-alpha.1
v0.6.0-alpha.2
v0.6.0-alpha.3
v0.7.0
v0.7.0-alpha.1
v0.7.0-alpha.2
v0.7.0-alpha.3
v0.7.0-alpha.4
v1.*
v1.0.0
v1.0.0-alpha.1
v1.0.0-alpha.2
v1.0.0-alpha.3
v1.1.0
v1.1.1
v1.10.0
v1.11.0
v1.12.0
v1.12.0-alpha.1
v1.13.0
v1.13.0-alpha.1
v1.13.0-alpha.2
v1.13.0-alpha.3
v1.13.0-alpha.4
v1.14.0
v1.14.0-alpha.1
v1.14.0-alpha.2
v1.15.0
v1.15.1-alpha.3
v1.16.0+alpha.1
v1.16.0+alpha.2
v1.16.0-rc1
v1.17.0
v1.18.0-alpha.1
v1.18.0-alpha.2
v1.18.0-alpha.3
v1.18.0-rc1
v1.19.0
v1.19.0-alpha.1
v1.2.0
v1.2.0-alpha.1
v1.2.0-alpha.2
v1.20.0
v1.20.0-alpha.1
v1.21.0-alpha.1
v1.21.0-alpha.2
v1.21.0-alpha.3
v1.22.0+alpha.1
v1.22.0+alpha.2
v1.22.0+alpha.3
v1.23.0+alpha.1
v1.23.0-alpha.1
v1.24.0-rc2
v1.25.0
v1.25.0-alpha.1
v1.25.0-rc1
v1.25.0-rc2
v1.25.0-rc3
v1.3.0
v1.3.1
v1.4.0
v1.5.0
v1.5.1
v1.6.0
v1.7.0
v1.8.0
v1.8.0-alpha.1
v1.9.0
v1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-1548.json"