cve/2022/CVE-2022-1332.md

### [CVE-2022-1332](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1332)
![](https://img.shields.io/static/v1?label=Product&message=Mattermost&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=6.4%3C%206.4.2%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brighgreen)

### Description

One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents.

### POC

#### Reference
- https://mattermost.com/security-updates/

#### Github
No PoCs found on GitHub currently.
Update Sat May 25 21:48:12 CEST 2024 2024-05-25 21:48:12 +02:00			`### [CVE-2022-1332](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1332)`
			`![](https://img.shields.io/static/v1?label=Product&message=Mattermost&color=blue)`
			`![](https://img.shields.io/static/v1?label=Version&message=6.4%3C%206.4.2%20&color=brighgreen)`
			`![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brighgreen)`

			`### Description`

			`One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents.`

			`### POC`

			`#### Reference`
			`- https://mattermost.com/security-updates/`

			`#### Github`
			`No PoCs found on GitHub currently.`