Oauth authorization codes do not expire when deauthorizing an oauth2 app
CVE-2023-2193

9.1CRITICAL

Key Information:

Vendor
Mattermost
Status
Mattermost
Vendor
CVE Published:
20 April 2023

Summary

Mattermost has a security issue that permits the unauthorized use of existing authorization codes when an OAuth2 app is deauthorized. This flaw allows an attacker who possesses a valid authorization code to produce a legitimate access token, potentially compromising sensitive user data and system integrity. Immediate attention is advised to mitigate the impact of this vulnerability.

Affected Version(s)

Mattermost 0 <= 7.1.7

Mattermost 0 <= 7.7.3

Mattermost 0 <= 7.8.2

References

https://mattermost.com/security-updates/

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

whitehattushu
.