CVE-2022-1002

Опубликовано: 18 мар. 2022

Источник: nvd

CVSS3: 2

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with special permissions to invite guest users to inject unescaped HTML content in the email invitations.

Ссылки

https://hackerone.com/reports/1443567
Exploit
Third Party Advisory
https://mattermost.com/security-updates/
Release Notes
Vendor Advisory
https://hackerone.com/reports/1443567
Exploit
Third Party Advisory
https://mattermost.com/security-updates/
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*

Версия до 6.4.0 (исключая)

EPSS

Процентиль: 48%

0.00246

Низкий

2 Low

CVSS3

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-80

CWE-79

Связанные уязвимости

CVE-2022-1002

CVSS3: 2

debian

больше 3 лет назад

Mattermost 6.3.0 and earlier fails to properly sanitize the HTML conte ...

GHSA-wmx6-cwpq-6j42

CVSS3: 5.4

github

больше 3 лет назад

EPSS

Процентиль: 48%

0.00246

Низкий

2 Low

CVSS3

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-80

CWE-79