CVE-2023-49607

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialog.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-754

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	<= 8.1.5; <= 9.0.3; <= 9.1.2; <= 9.2.1

References

https://mattermost.com/security-updatesIssue Tracking, Vendor Advisory
https://mattermost.com/security-updatesIssue Tracking, Vendor Advisory

Timeline

Published: Dec 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-49615.4The Poptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'poptin-form' shortcode in versions up to, and including, 1 CVE-2023-496108.1MachineSense FeverWarn Raspberry Pi-based devices lack input sanitization, which could allow an attacker on an adjacent network to send a me CVE-2023-496145.7Out of bounds write in firmware for some Intel(R) FPGA products before version 2.9.0 may allow escalation of privilege and information discl CVE-2023-496157.5Improper input validation in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to poten CVE-2023-496179.1The MachineSense application programmable interface (API) is improperly protected and can be accessed without authentication. A remote attac CVE-2023-496187.5Improper buffer restrictions in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to po CVE-2023-496193.1Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer. This issue affe CVE-2023-49625.4The Video PopUp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'video_popup' shortcode in versions up to, and includi CVE-2023-496206.5Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sq CVE-2023-496219.8A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected a CVE-2023-496229.8Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'itemnameid' parameter of the material_bi CVE-2023-496249.8Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cancelid' parameter of the material_bill