ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2023-2788

—
CVSS 3.1
6.5 medium
EPSS
<1%p41
Published
()
Modified
Description

Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated.

Vendors
mattermost
Products
mattermost
Weakness
CWE-862, CWE-613
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news

No ingested article mentions this CVE yet.