CVE-2023-2788
16.06.2023, 09:15
Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated.Enginsight
| Vendor | Product | Version |
|---|---|---|
| mattermost | mattermost | 7.1.0 ≤ 𝑥 ≤ 7.1.9 |
| mattermost | mattermost | 7.8.0 ≤ 𝑥 ≤ 7.8.4 |
| mattermost | mattermost | 7.9.0 ≤ 𝑥 ≤ 7.9.3 |
| mattermost | mattermost | 7.10.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-862 - Missing AuthorizationThe software does not perform an authorization check when an actor attempts to access a resource or perform an action.
- CWE-613 - Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."