Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attackers account is deactivated.
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mattermost | Mattermost | 7.1.0 (including) | 7.1.9 (including) |
| Mattermost | Mattermost | 7.8.0 (including) | 7.8.4 (including) |
| Mattermost | Mattermost | 7.9.0 (including) | 7.9.3 (including) |
| Mattermost | Mattermost | 7.10.0 (including) | 7.10.0 (including) |