Security readout for executives and security teams
Plain-English summary
Mattermost installations on version 6.7.0 or earlier may treat a request header as a trusted client IP by default. An attacker could use that to weaken some rate limits and make audit logs show manipulated IP addresses, reducing abuse controls and investigation reliability.
Executive priority
Prioritize this for exposed Mattermost systems, but treat it as moderate urgency unless additional abuse evidence exists. The main risk is weakened throttling and unreliable audit attribution, which can complicate account-abuse response and incident investigations.
Technical view
CVE-2022-2366 is a CWE-276 incorrect-defaults issue in Mattermost. The trusted IP header default can let unauthenticated network attackers bypass some rate limitations or influence IP values recorded in audit logs. The CVSS 3.1 score is 5.6 with high attack complexity and low confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely for internet-facing or partner-accessible Mattermost deployments running 6.7.0 or earlier, especially 6.5.x, 6.6.x, and 6.7.0 configurations relying on built-in rate limiting or IP-based audit evidence.
Exploitation context
The source bundle does not show active exploitation, and KEV is false. The issue requires manipulating request headers and depends on Mattermost’s trusted IP header behavior. Business impact is mainly abuse-control bypass and degraded audit-log trust, not direct system takeover.
Researcher notes
Evidence is limited to the CVE description, CVSS vector, affected version list, and Mattermost security-update reference. The bundle does not identify a specific fixed version, patch note, or observed exploitation campaign, so remediation should be tied to current Mattermost vendor guidance.
Mitigation direction
- Identify all Mattermost deployments and versions, including externally exposed instances.
- Review Mattermost security updates for the vendor-supported fix or configuration guidance.
- Update affected Mattermost instances according to vendor guidance.
- Review trusted IP header settings against Mattermost guidance.
- Do not treat client-supplied IP headers as trusted without explicit proxy validation.
- Monitor for unusual authentication attempts and inconsistent audit-log IP patterns.
Validation and detection
- Confirm whether each Mattermost instance is version 6.7.0 or earlier.
- Check whether trusted IP header defaults are still in use.
- Verify vendor-recommended update or configuration change in staging first.
- Review audit logs for repeated actions from inconsistent or implausible IP addresses.
- Confirm rate-limiting behavior after remediation using approved internal testing only.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-276: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-2366 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L2.23.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.6MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://mattermost.com/security-updates/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Default Permissions
Incorrect Default Permissions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.