What’s Vulnerable › Vulnerabilities
CVE-2022-2366: Incorrect defaults can cause attackers to bypass rate limitations
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-07-12 · updated 2026-06-17
- Weakness: CWE-276
Description
Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers.
Affected products
- Mattermost: before 6.3.9; from 6.4.0 before 6.5.2; from 6.6.0 before 6.6.2; 6.7.0 — fixed in 6.3.9, 6.5.2, 6.6.2
How to fix
Upgrade to a fixed version: Mattermost 6.3.9, 6.5.2, 6.6.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2022-2366 or the next vulnerability affects your stack