CVE-2023-47168

Summary

Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providing a invalid custom url scheme in /oauth/{service}/mobile_login?redirect_to=

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost0 <= 8.1.3affected
MattermostMattermost0 <= 7.8.12affected
MattermostMattermost0 <= 9.0.1affected
MattermostMattermost0 <= 9.1.0affected
MattermostMattermost9.0.2unaffected
MattermostMattermost9.1.1unaffected
MattermostMattermost7.8.13unaffected
MattermostMattermost8.1.4unaffected

Weaknesses

  • CWE-601: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References