What is CVE-2023-3613?

CVE-2023-3613 is a vulnerability in the Mattermost WelcomeBot plugin that allows guest accounts to be added or invited to channels without proper validation of their membership status.

How does CVE-2023-3613 affect Mattermost Server?

CVE-2023-3613 affects Mattermost Server versions up to 7.8.6 and versions between 7.9.0 and 7.10.3.

What is the severity of CVE-2023-3613?

CVE-2023-3613 has a severity level of 3.5 (low).

How can I fix CVE-2023-3613?

To fix CVE-2023-3613, update your Mattermost Server to a version that is not affected by the vulnerability.

Where can I find more information about CVE-2023-3613?

You can find more information about CVE-2023-3613 in the security updates page of Mattermost's official website.

Vulnerability/
CVE-2023-3613

low

3.5

CWE

863

17/7/2023

2/8/2024

CVE-2023-3613: Guest accounts invited and added to channels by Welcomebot plugin

First published: Mon Jul 17 2023(Updated: )

Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by default.

Credit: responsibledisclosure@mattermost.com responsibledisclosure@mattermost.com

Affected Software	Affected Version	How to fix
Mattermost Mattermost Server	<7.8.6
Mattermost Mattermost Server	>=7.9.0<7.10.3

Remedy

Update Mattermost to versions 7.8.6, 7.10.3 or higher. Alternatively, update the WelcomeBot plugin to version 1.3.0 or higher.

Never miss a vulnerability like this again

Reference Links

https://mattermost.com/security-updates

Frequently Asked Questions

What is CVE-2023-3613?
CVE-2023-3613 is a vulnerability in the Mattermost WelcomeBot plugin that allows guest accounts to be added or invited to channels without proper validation of their membership status.
How does CVE-2023-3613 affect Mattermost Server?
CVE-2023-3613 affects Mattermost Server versions up to 7.8.6 and versions between 7.9.0 and 7.10.3.
What is the severity of CVE-2023-3613?
CVE-2023-3613 has a severity level of 3.5 (low).
How can I fix CVE-2023-3613?
To fix CVE-2023-3613, update your Mattermost Server to a version that is not affected by the vulnerability.
Where can I find more information about CVE-2023-3613?
You can find more information about CVE-2023-3613 in the security updates page of Mattermost's official website.

collector/nvd-latest
collector/nvd-index
agent/author
agent/type
agent/softwarecombine
collector/nvd-api
agent/software-canonical-lookup-request
agent/references
agent/weakness
agent/description
collector/mitre-cve
source/MITRE
agent/severity
agent/last-modified-date
agent/remedy
agent/title
agent/first-publish-date
agent/event
agent/tags
vendor/mattermost
canonical/mattermost mattermost server
version/mattermost mattermost server/7.9.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.