CVE-2023-2788

CVSS V2 None CVSS V3 None

Description

Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated.

Overview

CVE ID
CVE-2023-2788

Assigner
Mattermost

Vulnerability Status
PUBLISHED

Published Version
2023-06-16T08:58:15.392Z

Last Modified Date
2023-06-16T08:58:15.392Z

Weakness Enumerations

CWE	URL
CWE-862	http://cwe.mitre.org/data/definitions/862.html

References

Reference URL	Reference Tags
https://mattermost.com/security-updates/

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-2788
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2788

History

Created	Old Value	New Value	Data Type	Notes
2024-06-24 22:13:32				Added to TrackCVE