Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-2788

Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated.

Published

2023-06-16T09:15:09.993

Last Modified

2024-11-21T07:59:17.493

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.2 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-862
  • Type: Primary
    CWE-613
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application mattermost mattermost ≤ 7.1.9 Yes
Application mattermost mattermost ≤ 7.8.4 Yes
Application mattermost mattermost ≤ 7.9.3 Yes
Application mattermost mattermost 7.10.0 Yes
References