CVE-2023-4478

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published
Aug 25, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-44795.4Stored XSS Vulnerability in M-Files Web versions before 23.8 allows attacker to execute script on users browser via stored HTML document witCVE-2023-447949.8An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.CVE-2023-447965.4Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a craCVE-2023-44805.5Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted rCVE-2023-448079.8D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the cancelPing function.CVE-2023-448089.8D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_4507CC function.CVE-2023-448099.8D-Link device DIR-820L 1.05B03 is vulnerable to Insecure Permissions.CVE-2023-44817.5An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an CVE-2023-448118.8Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitiveCVE-2023-448126.1Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to thCVE-2023-448136.1Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to thCVE-2023-44825.4The Auto Amazon Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in versions up to, and inclu