PT-2023-29295 · Unknown · Mattermost

0Aqd · Published 2023-08-25 · Updated 2024-03-06 · CVE-2023-4478

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Mattermost (affected versions not specified)

Description The issue allows an attacker to register users as inactive during signup by manipulating parameters, thus blocking them from later accessing the system without the system admin activating their accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BIT-MATTERMOST-2023-4478

CVE-2023-4478

Affected Products

Mattermost

References · 7

• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4478 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4478 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mattermost-2023-4478 · Vendor Advisory
• https://t.me/cibsecurity/69186 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4478 · Note
• https://t.me/cvenotify/57279 · Telegram Post