CVE-2023-2788: Deactivated user can retain access using oauth2 api
Published Jun 16, 2023
·Updated
Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated.
Affected Software
4 affected components
Mattermost Mattermost>=7.1.0<=7.1.9
Mattermost Mattermost>=7.8.0<=7.8.4
Mattermost Mattermost>=7.9.0<=7.9.3
Mattermost Mattermost=7.10.0
Remediation
Information
Update Mattermost to version 7.1.10, 7.8.5, 7.9.4, 7.10.1 or higher.
Event History
Jun 16, 2023
CVE Published
via MITRE·08:58 AM
Data Sourced
via MITRE·08:58 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-2788.
2
What is the severity of CVE-2023-2788?
The severity of CVE-2023-2788 is medium with a CVSS score of 6.5.
3
How does Mattermost fail to check if an admin user account is active after an oauth2 flow is started?
Mattermost fails to check if an admin user account is active after an oauth2 flow is started, allowing an attacker to retain persistent access.
4
Who can exploit this vulnerability?
An attacker with admin privileges can exploit this vulnerability.
5
What is the affected version range of Mattermost?
Mattermost versions 7.1.0 to 7.1.9, 7.8.0 to 7.8.4, 7.9.0 to 7.9.3, and 7.10.0 are affected.