CVE-2023-3613

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by default.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Jul 17, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-361319.8PHPJabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control due to improper input validation of password parameteCVE-2023-361329.8PHP Jabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control.CVE-2023-361339.8PHPJabbers Availability Booking Calendar 5.0 is vulnerable to User Account Takeover through username/password change.CVE-2023-361349.8In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allowsCVE-2023-361357.5User enumeration is found in in PHPJabbers Class Scheduling System v1.0. This issue occurs during password recovery, where a difference in mCVE-2023-361366.5PHPJabbers Class Scheduling System 1.0 lacks encryption on the password when editing a user account (update user page) allowing an attacker CVE-2023-361376.1There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Class Scheduling System 1.0.CVE-2023-361386.1PHPJabbers Cleaning Business Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the theme parameter of preview.php.CVE-2023-361399.8In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) alloCVE-2023-36143.3Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server resources, making theCVE-2023-361409.8In PHPJabbers Cleaning Business Software 1.0, there is no encryption on user passwords allowing an attacker to gain access to all user accouCVE-2023-361415.3User enumeration is found in in PHPJabbers Cleaning Business Software 1.0. This issue occurs during password recovery, where a difference in
CVE-2023-3613: Low severity, CVSS 3.5 | Vulnix