VULNERABILITY INTELLIGENCE

CVE-2022-1002

CVSS score2 LOW

EPSS probability0.65%

CISA KEVNot currently listed

Published2022-03-18

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

Description

Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with special permissions to invite guest users to inject unescaped HTML content in the email invitations.

Weakness classification

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Primary references

responsibledisclosure@mattermost.com — Exploit, Third Party Advisory
responsibledisclosure@mattermost.com — Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory