GHSA-fxwj-v664-wv5g

Source

https://github.com/advisories/GHSA-fxwj-v664-wv5g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-fxwj-v664-wv5g/GHSA-fxwj-v664-wv5g.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fxwj-v664-wv5g

Aliases

Published

2022-04-20T00:00:30Z

Modified

2024-08-21T15:41:39.337392Z

Severity

4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Improper Control of a Resource Through its Lifetime in Mattermost

Details

Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.

Database specific

{
    "nvd_published_at": "2022-04-19T21:15:00Z",
    "cwe_ids": [
        "CWE-664",
        "CWE-668"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-22T20:57:43Z"
}

References

Affected packages

Go / github.com/mattermost/mattermost-server/v6

Package

Name: github.com/mattermost/mattermost-server/v6; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost-server/v6

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.5.0