CVE-2023-2788
- Source
- https://cve.org/CVERecord?id=CVE-2023-2788
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-2788.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-2788
- Published
- 2023-06-16T08:58:15.392Z
- Modified
- 2026-07-15T01:49:10.751847421Z
- Severity
-
- 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
- Summary
- Deactivated user can retain access using oauth2 api
- Details
-
Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated.
- Database specific
{ "cwe_ids": [ "CWE-862" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2788.json", "unresolved_ranges": [ { "extracted_events": [ { "last_affected": "7.1.9" }, { "last_affected": "7.8.4" }, { "last_affected": "7.9.3" }, { "introduced": "7.10.0" }, { "last_affected": "7.10.0" } ], "source": "AFFECTED_FIELD" } ], "cna_assigner": "Mattermost" }- References
Affected packages
Git / github.com/mattermost/mattermost
Affected ranges
- Type
- GIT
- Repo
- https://github.com/mattermost/mattermost
- Events
-
IntroducedLast affectedIntroducedLast affectedIntroducedLast affectedIntroducedLast affected
- Database specific
{ "cpe": [ "cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*", "cpe:2.3:a:mattermost:mattermost:7.10.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "7.1.0" }, { "last_affected": "7.1.9" }, { "introduced": "7.8.0" }, { "last_affected": "7.8.4" }, { "introduced": "7.9.0" }, { "last_affected": "7.9.3" }, { "introduced": "7.10.0" }, { "last_affected": "7.10.0" } ], "source": [ "CPE_RANGE", "CPE_STRING" ] }