by Kastro
Paper/Archive/CVE-2023-2193

CVE-2023-2193

Mattermost Mattermost — Oauth authorization codes do not expire when deauthorizing an oauth2 app

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
37
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 48.2.482 × 209.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token.

Affected

ProductAffectedFixed inSource
Mattermost≤ 7.1.77.10CNA
Mattermost≤ 7.7.37.10CNA
Mattermost≤ 7.8.27.10CNA
Mattermost≤ 7.9.17.10CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Mattermost (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refmattermost.com/security-updates