CVE-2023-3613

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by default.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Mattermost	Mattermost Plugins	<= 7.8.5; <= 7.10.2

References

https://mattermost.com/security-updatesVendor Advisory
https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Jul 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-361319.8PHPJabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control due to improper input validation of password paramete CVE-2023-361329.8PHP Jabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control.CVE-2023-361339.8PHPJabbers Availability Booking Calendar 5.0 is vulnerable to User Account Takeover through username/password change.CVE-2023-361349.8In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows CVE-2023-361357.5User enumeration is found in in PHPJabbers Class Scheduling System v1.0. This issue occurs during password recovery, where a difference in m CVE-2023-361366.5PHPJabbers Class Scheduling System 1.0 lacks encryption on the password when editing a user account (update user page) allowing an attacker CVE-2023-361376.1There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Class Scheduling System 1.0.CVE-2023-361386.1PHPJabbers Cleaning Business Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the theme parameter of preview.php.CVE-2023-361399.8In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allo CVE-2023-36143.3Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server resources, making the CVE-2023-361409.8In PHPJabbers Cleaning Business Software 1.0, there is no encryption on user passwords allowing an attacker to gain access to all user accou CVE-2023-361415.3User enumeration is found in in PHPJabbers Cleaning Business Software 1.0. This issue occurs during password recovery, where a difference in