Medium · 4.8 CVE-2023-3591 EUVD-2023-44241GHSA-g328-hf66-x5p7

Lack of previous password reset tokens on new token creation

Published Jul 17, 2023 · Updated Oct 21, 2024 · Assigned by Mattermost

Description

Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.

Vendor	Product	Affected	Fixed
Mattermost	Mattermost	≤ 7.8.6, ≤ 7.9.4, ≤ 7.10.2	7.8.7

CNA	v3.1	4.8
EUVD	v3.1	4.8