CVE-2023-4478
Last modified
CVE-2023-4478 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts. . EPSS estimates a 0.44% chance of exploitation in the next 30 days.
Description
Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost Server | < 7.8.9 |
| Mattermost | Mattermost Server | >= 7.9.0, < 7.10.5 |
| Mattermost | Mattermost Server | 8.0.0 |
References
- https://mattermost.com/security-updatesVendor Advisory
- https://mattermost.com/security-updatesVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-4478?
How severe is CVE-2023-4478?
How do I fix CVE-2023-4478?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-44765A Cross Site Scripting (XSS) vulnerability in Concrete CMS v…5.4
- CVE-2023-44766A Cross Site Scripting (XSS) vulnerability in Concrete CMS v…4.8
- CVE-2023-44767A File upload vulnerability in RiteCMS 3.0 allows a local at…4.8
- CVE-2023-44769A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.…5.4
- CVE-2023-44770A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.…5.4
- CVE-2023-44771A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.…5.4
- CVE-2023-4479Stored XSS Vulnerability in M-Files Web versions before 23.8…5.4
- CVE-2023-44793Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2023-44794An issue in Dromara SaToken version 1.36.0 and before allows…9.8
- CVE-2023-44796Cross Site Scripting (XSS) vulnerability in LimeSurvey befor…5.4
- CVE-2023-4480 Due to an out-of-date dependency in the “Fusion File Manage…5.5
- CVE-2023-44807D-Link DIR-820L 1.05B03 has a stack overflow vulnerability i…9.8
Are you affected by CVE-2023-4478?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST