title: Incorrect defaults can cause attackers to bypass rate limitations
description: Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers.
problem types: CWE-276 Incorrect Default Permissions
affected:
{
product: Mattermost
vendor: Mattermost
versions:
status: affected, version: 6.7.x 6.7.0
lessThanOrEqual: 6.3.8, status: affected, version: 6.x, versionType: custom
lessThanOrEqual: 6.5.1, status: affected, version: 6.5.x, versionType: custom
lessThanOrEqual: 6.6.1, status: affected, version: 6.6.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
]