CVE-2021-37862

Published: Dec 17, 2021Modified: Nov 21, 2024

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: NVD

Description

Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token.

Affected (1)

Products: Mattermost: Mattermost Server

Mattermost

1 product

Mattermost Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mattermost Mattermost Server	Up to 6.0

Related CWEs

CWE-754

Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

References (4)

https://hackerone.com/reports/1357013

Source: responsibledisclosure@mattermost.com

Permissions Required

https://mattermost.com/security-updates/

Source: responsibledisclosure@mattermost.com

Vendor Advisory

https://hackerone.com/reports/1357013

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

https://mattermost.com/security-updates/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.