CVE-2022-1384

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-477CWE-862

Affected software

VendorProductVersions
MattermostMattermost>= unspecified, <= 6.4

References

Timeline

Published
Apr 19, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-13854.6Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, whCVE-2022-13869.8The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used toCVE-2022-13874.8The No Future Posts WordPress plugin through 1.4 does not escape its settings, which could allow high privilege users such as admin to perfoCVE-2022-13889.8On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior CVE-2022-13894.3On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site request forgery (CSRF) vuCVE-2022-13909.8The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unautheCVE-2022-13919.8The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, whicCVE-2022-13927.5The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could leCVE-2022-13935.4The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle field and provides a shortcode to display it via [wp_subtitle]. The subtitle iCVE-2022-13944.8The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high CVE-2022-13954.8The Easy FAQ with Expanding Text WordPress plugin through 3.2.8.3.1 does not sanitise and escape its settings, allowing high privilege usersCVE-2022-13964.8The Donorbox WordPress plugin before 7.1.7 does not sanitise and escape its Campaign URL settings before outputting it in an attribute, lead
CVE-2022-1384: High severity, CVSS 8.8 | Vulnix