CVE-2023-2193: Oauth authorization codes do not expire when deauthorizing an oauth2 app
Published Apr 20, 2023
·Updated
Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token.
Affected Software
4 affected components
Mattermost Mattermost=7.1.7
Mattermost Mattermost=7.7.3
Mattermost Mattermost=7.8.2
Mattermost Mattermost=7.9.1
Remediation
Information
Update Mattermost to version v7.10, v7.9.3, v7.8.4, v7.7.5, v7.1.9 or higher.
Event History
Apr 20, 2023
CVE Published
via MITRE·08:17 AM
Data Sourced
via MITRE·08:17 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this Mattermost vulnerability?
The vulnerability ID for this Mattermost vulnerability is CVE-2023-2193.
2
What is the severity rating of CVE-2023-2193?
CVE-2023-2193 has a severity rating of 9.1 (critical).
3
Which versions of Mattermost are affected by CVE-2023-2193?
Mattermost versions 7.1.7, 7.7.3, 7.8.2, and 7.9.1 are affected by CVE-2023-2193.
4
What is the impact of CVE-2023-2193?
CVE-2023-2193 allows an attacker possessing an authorization code to generate an access token.
5
How can I fix CVE-2023-2193 in Mattermost?
To fix CVE-2023-2193 in Mattermost, upgrade to a version that has the security patch applied.