Low severity · published Jul 17, 2023
CVE-2023-3613
Guest accounts invited and added to channels by Welcomebot plugin
3.5
CVSS
0.3%
EPSS
No
On KEV
Description
Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by default.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MP
Mattermost Plugins · Mattermost
through 7.8.5; through 7.10.2 · source: vendor
MS
Mattermost Server · Mattermost
before 7.8.6; 7.9.0 before 7.10.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3613
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3613
Vendor Advisory
https://mattermost.com/security-updates
More from Mattermost Plugins
7.5
CVE-2019-20864
An issue was discovered in Mattermost Plugins before 5.13.0