VULNERABILITY INTELLIGENCE

CVE-2022-2366

CVSS score5.6 MEDIUM
EPSS probability0.64%
CISA KEVNot currently listed
Published2022-07-12
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Description

Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers.

Weakness classification

  • responsibledisclosure@mattermost.com: CWE-276
  • nvd@nist.gov: CWE-276

Primary references