CVE-2022-1002

LOW

Mattermost < 6.4.0 - Cross-Site Scripting via Guest User Email Invitation

Title source: llm
STIX 2.1

Description

Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with special permissions to invite guest users to inject unescaped HTML content in the email invitations.

References (2)

Core 2
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://mattermost.com/security-updates/
Exploit, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/1443567

Scores

CVSS v3 2.0
EPSS 0.0021
EPSS Percentile 42.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-80 CWE-79
Status published
Products (1)
mattermost/mattermost < 6.4.0
Published Mar 18, 2022
Tracked Since Feb 18, 2026