CVE-2022-1384: Insecure plugin handling in Mattermost
Summary
CVE-2022-1384: Insecure plugin handling in Mattermost. Affects github.com/mattermost/mattermost-server/v6 versions >= 6.4.0, < 6.5.0. Fixed in 6.5.0. How to fix ↓
Also tracked for
- github.com/mattermost/mattermost-server · Go
- mattermost · Bitnami
The same CVE-2022-1384 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mattermost is an open-source messaging platform that allows teams to communicate and collaborate. It is written in Go and provides various features such as messaging, file sharing, and integrations. Mattermost version 6.4.x and earlier are affected by a vulnerability that allows an authenticated and authorized user to install and exploit an old plugin version from the Marketplace, which may have known vulnerabilities.
Vulnerability Detail
The vulnerability in Mattermost arises from the improper checking of plugin versions when installing plugins from the Marketplace. This allows an attacker with authenticated and authorized access to install and exploit outdated plugin versions that may contain known vulnerabilities. By leveraging these vulnerabilities, an attacker could potentially gain unauthorized access, execute arbitrary code, or perform other malicious activities on the affected system.
How To Fix
Latest published version: v6.7.2 as of 23 Oct 2026
go get github.com/mattermost/mattermost-server/v6@v6.7.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.5.0
This is the first release that contains the fix.
go get github.com/mattermost/mattermost-server/v6@v6.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by ensuring they only install plugins from trusted sources and regularly update their plugins to the latest versions.
Conclusion
In conclusion, Mattermost versions 6.4.x and earlier are vulnerable to an insecure plugin handling issue. To mitigate this vulnerability, it is crucial to update Mattermost to version 6.5.0 or later and regularly update plugins. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/mattermost/mattermost-server/v6 →
FAQ
Mattermost is an open-source messaging platform that enables teams to communicate and collaborate.
The vulnerability allows an authenticated and authorized user to install and exploit outdated plugin versions, potentially leading to unauthorized access or execution of arbitrary code.
To fix this vulnerability, update Mattermost to version 6.5.0 or later and regularly update plugins to the latest versions.
While there are no specific workarounds, users can mitigate the risk by only installing plugins from trusted sources and keeping plugins up to date.
There are no known public exploits for this vulnerability at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/mattermost/mattermost-server/v6.
