CVE-2023-4478

Parameter tampering in the registration resulting in blocked accounts to be created

State: Published
Severity: 4.3 Medium
Published: Aug 25, 2023
Updated: Sep 30, 2024
Reserved: Aug 22, 2023

Description

Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	Mattermost

Weaknesses

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Affected Products

Product	Versions
MattermostMattermost	7.8.8 and earlierAffected 7.10.4 and earlierAffected 7.8.9Not affected 7.10.5Not affected 8.0.1 Not affected 8.0.0Affected

References

https://mattermost.com/security-updates

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.