CVE-2023-49607

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-49607
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49607.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-49607
Aliases
Published
2023-12-12T08:21:36.568Z
Modified
2026-07-08T06:33:00.683243765Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Playbook plugin crash via missing interface type assertion
Details

Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialog.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "last_affected": "8.1.5"
                },
                {
                    "last_affected": "9.0.3"
                },
                {
                    "last_affected": "9.1.2"
                },
                {
                    "last_affected": "9.2.1"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49607.json",
    "cna_assigner": "Mattermost",
    "cwe_ids": [
        "CWE-754"
    ]
}
References

Affected packages

Git / github.com/mattermost/mattermost

Affected ranges

Type
GIT
Repo
https://github.com/mattermost/mattermost
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b245d967c8c3d158a899c38166151254d6ee0d11
Introduced
90f502dc2dc80ee25cfb7d7bc3e743b53564a5a7
Last affected
f8f79e13ef11d5bd2527d21a1967bd37f46a0fae
Introduced
987e843629fe3f11861fda23ceb66884f5973ef1
Last affected
b10aa047bb5ef35b1a8936117febf8eddd225389
Introduced
5934ff113becf755beb978cc7bd1ba6564cbbdd6
Last affected
8b59886e511030e0156749de0b327a4db004f765
Introduced
b47be1c0f5787562ddf430dd5c5b8b3c35748b06
Last affected
d3dae4d45e22e6239c409427d798274c0df16ccc
Introduced
c6bb01661fdcdb5536d8fd978e52447c0624a1b1
Last affected
c6bb01661fdcdb5536d8fd978e52447c0624a1b1
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:mattermost:mattermost_server:9.1.1:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.8.14"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "last_affected": "8.1.5"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "last_affected": "9.0.3"
        },
        {
            "introduced": "9.1.0"
        },
        {
            "last_affected": "9.1.2"
        },
        {
            "introduced": "9.2.0"
        },
        {
            "last_affected": "9.2.1"
        },
        {
            "introduced": "9.1.1"
        },
        {
            "last_affected": "9.1.1"
        }
    ]
}

Affected versions

9.*
9.1.1
@mattermost/client@8.*
@mattermost/client@8.1.1
@mattermost/client@9.*
@mattermost/client@9.0.0
@mattermost/client@9.2.0
@mattermost/types@8.*
@mattermost/types@8.1.1
@mattermost/types@9.*
@mattermost/types@9.0.0
@mattermost/types@9.2.0
Other
cloud-2022-07-20-1
cloud-2022-08-10-1
cloud-2022-09-08-1
cloud-2022-10-06-1
cloud-2022-11-11-1
cloud-2022-11-24-1
cloud-2023-01-26-1
cloud-2023-07-26-1
server/public/v0.*
server/public/v0.0.5
v0.*
v0.5.0
v4.*
v4.10.0-rc1
v4.2.0-rc1
v4.3.0-rc1
v4.4.0-rc1
v4.5.0-rc1
v4.6.0-rc1
v4.6.0-rc2
v4.7.0-rc1
v4.8.0-rc1
v4.9.0-rc1
v5.*
v5.0.0-rc1
v5.1.0-rc1
v5.2.0-rc1
v5.2.0-rc2
v7.*
v7.8.0
v7.8.1
v7.8.10
v7.8.10-rc3
v7.8.10-rc4
v7.8.10-rc5
v7.8.11
v7.8.11-rc1
v7.8.12
v7.8.12-rc1
v7.8.12-rc2
v7.8.13
v7.8.13-rc1
v7.8.14
v7.8.14-rc1
v7.8.2
v7.8.3
v7.8.4
v7.8.5
v7.8.6
v7.8.7
v7.8.8
v7.8.9
v8.*
v8.1.0
v8.1.0-rc2
v8.1.1
v8.1.1-rc1
v8.1.1-rc2
v8.1.2
v8.1.2-rc1
v8.1.2-rc2
v8.1.3
v8.1.3-rc1
v8.1.3-rc2
v8.1.4
v8.1.4-rc1
v8.1.4-rc2
v8.1.5
v8.1.5-rc1
v8.1.5-rc2
v9.*
v9.0.0
v9.0.0-rc2
v9.0.1
v9.0.1-rc1
v9.0.2
v9.0.2-rc1
v9.0.3
v9.0.3-rc1
v9.1.1
v9.1.1-rc1
v9.1.2
v9.1.2-rc1
v9.2.0
v9.2.0-rc2
v9.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49607.json"