Vulnerability-Lookup

WID-SEC-W-2025-1856

Vulnerability from csaf_certbund - Published: 2025-08-17 22:00 - Updated: 2025-09-22 22:00

Summary

Mattermost Server: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Angriff

Ein Angreifer kann mehrere Schwachstellen in Mattermost Server ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder Code auszuführen.

Betroffene Betriebssysteme

- Linux - Sonstiges - UNIX - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Mattermost ist ein webbasierter Instant-Messaging-Dienst.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Mattermost Server ausnutzen, um Informationen offenzulegen, Sicherheitsma\u00dfnahmen zu umgehen oder Code auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-1856 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1856.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-1856 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1856"
      },
      {
        "category": "external",
        "summary": "Mattermost Security Updates vom 2025-08-17",
        "url": "https://mattermost.com/security-updates/#server"
      }
    ],
    "source_lang": "en-US",
    "title": "Mattermost Server: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-09-22T22:00:00.000+00:00",
      "generator": {
        "date": "2025-09-23T06:26:09.791+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.4.0"
        }
      },
      "id": "WID-SEC-W-2025-1856",
      "initial_release_date": "2025-08-17T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-08-17T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2025-09-15T22:00:00.000+00:00",
          "number": "2",
          "summary": "CVE\u0027s erg\u00e4nzt, Beschreibung aktualisiert"
        },
        {
          "date": "2025-09-22T22:00:00.000+00:00",
          "number": "3",
          "summary": "CVEs erg\u00e4nzt, Beschreibung und Bewertung angepasst"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Servr \u003c10.11.0",
                "product": {
                  "name": "Mattermost Mattermost Servr \u003c10.11.0",
                  "product_id": "T046305"
                }
              },
              {
                "category": "product_version",
                "name": "Servr 10.11.0",
                "product": {
                  "name": "Mattermost Mattermost Servr 10.11.0",
                  "product_id": "T046305-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mattermost:mattermost_server:servr__10.11.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Servr \u003c10.10.2",
                "product": {
                  "name": "Mattermost Mattermost Servr \u003c10.10.2",
                  "product_id": "T046306"
                }
              },
              {
                "category": "product_version",
                "name": "Servr 10.10.2",
                "product": {
                  "name": "Mattermost Mattermost Servr 10.10.2",
                  "product_id": "T046306-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mattermost:mattermost_server:servr__10.10.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Servr \u003c10.5.10",
                "product": {
                  "name": "Mattermost Mattermost Servr \u003c10.5.10",
                  "product_id": "T046307"
                }
              },
              {
                "category": "product_version",
                "name": "Servr 10.5.10",
                "product": {
                  "name": "Mattermost Mattermost Servr 10.5.10",
                  "product_id": "T046307-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mattermost:mattermost_server:servr__10.5.10"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Servr \u003c10.9.5",
                "product": {
                  "name": "Mattermost Mattermost Servr \u003c10.9.5",
                  "product_id": "T046308"
                }
              },
              {
                "category": "product_version",
                "name": "Servr 10.9.5",
                "product": {
                  "name": "Mattermost Mattermost Servr 10.9.5",
                  "product_id": "T046308-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mattermost:mattermost_server:servr__10.9.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Servr \u003c10.8.4",
                "product": {
                  "name": "Mattermost Mattermost Servr \u003c10.8.4",
                  "product_id": "T046309"
                }
              },
              {
                "category": "product_version",
                "name": "Servr 10.8.4",
                "product": {
                  "name": "Mattermost Mattermost Servr 10.8.4",
                  "product_id": "T046309-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mattermost:mattermost_server:servr__10.8.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Servr \u003c10.5.9",
                "product": {
                  "name": "Mattermost Mattermost Servr \u003c10.5.9",
                  "product_id": "T046310"
                }
              },
              {
                "category": "product_version",
                "name": "Servr 10.5.9",
                "product": {
                  "name": "Mattermost Mattermost Servr 10.5.9",
                  "product_id": "T046310-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mattermost:mattermost_server:servr__10.5.9"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Servr \u003c9.11.18",
                "product": {
                  "name": "Mattermost Mattermost Servr \u003c9.11.18",
                  "product_id": "T046311"
                }
              },
              {
                "category": "product_version",
                "name": "Servr 9.11.18",
                "product": {
                  "name": "Mattermost Mattermost Servr 9.11.18",
                  "product_id": "T046311-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mattermost:mattermost_server:servr__9.11.18"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Servr \u003c10.9.4",
                "product": {
                  "name": "Mattermost Mattermost Servr \u003c10.9.4",
                  "product_id": "T046312"
                }
              },
              {
                "category": "product_version",
                "name": "Servr 10.9.4",
                "product": {
                  "name": "Mattermost Mattermost Servr 10.9.4",
                  "product_id": "T046312-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mattermost:mattermost_server:servr__10.9.4"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Mattermost"
          }
        ],
        "category": "vendor",
        "name": "Mattermost"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-9072",
      "product_status": {
        "known_affected": [
          "T046305",
          "T046306",
          "T046309",
          "T046307",
          "T046308",
          "T046312",
          "T046310",
          "T046311"
        ]
      },
      "release_date": "2025-08-17T22:00:00.000+00:00",
      "title": "CVE-2025-9072"
    },
    {
      "cve": "CVE-2025-9076",
      "product_status": {
        "known_affected": [
          "T046305",
          "T046306",
          "T046309",
          "T046307",
          "T046308",
          "T046312",
          "T046310",
          "T046311"
        ]
      },
      "release_date": "2025-08-17T22:00:00.000+00:00",
      "title": "CVE-2025-9076"
    },
    {
      "cve": "CVE-2025-9078",
      "product_status": {
        "known_affected": [
          "T046305",
          "T046306",
          "T046309",
          "T046307",
          "T046308",
          "T046312",
          "T046310",
          "T046311"
        ]
      },
      "release_date": "2025-08-17T22:00:00.000+00:00",
      "title": "CVE-2025-9078"
    },
    {
      "cve": "CVE-2025-9081",
      "product_status": {
        "known_affected": [
          "T046305",
          "T046306",
          "T046309",
          "T046307",
          "T046308",
          "T046312",
          "T046310",
          "T046311"
        ]
      },
      "release_date": "2025-08-17T22:00:00.000+00:00",
      "title": "CVE-2025-9081"
    },
    {
      "cve": "CVE-2025-9084",
      "product_status": {
        "known_affected": [
          "T046305",
          "T046306",
          "T046309",
          "T046307",
          "T046308",
          "T046312",
          "T046310",
          "T046311"
        ]
      },
      "release_date": "2025-08-17T22:00:00.000+00:00",
      "title": "CVE-2025-9084"
    },
    {
      "cve": "CVE-2025-9079",
      "product_status": {
        "known_affected": [
          "T046305",
          "T046306",
          "T046309",
          "T046307",
          "T046308",
          "T046312",
          "T046310",
          "T046311"
        ]
      },
      "release_date": "2025-09-15T22:00:00.000+00:00",
      "title": "CVE-2025-9079"
    }
  ]
}

CVE-2025-9084 (GCVE-0-2025-9084)

Vulnerability from cvelistv5 – Published: 2025-09-15 10:22 – Updated: 2025-09-15 12:24

Title

Open redirect in OAuth login

Summary

Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs

Severity ?

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

CWE

CWE-601 - CWE‑601: URL Redirection to Untrusted Site (“Open Redirect”)

Assigner

Mattermost

References

URL

Tags

https://mattermost.com/security-updates

Impacted products

	Vendor	Product	Version
	Mattermost	Mattermost	Affected: 10.5.0 , ≤ 10.5.9 (semver) Unaffected: 10.11.0 Unaffected: 10.5.10

Credits

Juho Forsén

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9084",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-15T12:24:31.375509Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-15T12:24:41.138Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mattermost",
          "vendor": "Mattermost",
          "versions": [
            {
              "lessThanOrEqual": "10.5.9",
              "status": "affected",
              "version": "10.5.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "10.11.0"
            },
            {
              "status": "unaffected",
              "version": "10.5.10"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Juho Fors\u00e9n"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mattermost versions 10.5.x \u003c= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE\u2011601: URL Redirection to Untrusted Site (\u201cOpen Redirect\u201d)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T10:22:30.184Z",
        "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "shortName": "Mattermost"
      },
      "references": [
        {
          "url": "https://mattermost.com/security-updates"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Mattermost to versions 10.11.0, 10.5.10 or higher."
        }
      ],
      "source": {
        "advisory": "MMSA-2025-00511",
        "defect": [
          "https://mattermost.atlassian.net/browse/MM-64754"
        ],
        "discovery": "{\"self\"=\u003e\"https://mattermost.atlassian.net/rest/api/2/customFieldOption/10557\", \"value\"=\u003e\"Internal\", \"id\"=\u003e\"10557\"}"
      },
      "title": "Open redirect in OAuth login"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
    "assignerShortName": "Mattermost",
    "cveId": "CVE-2025-9084",
    "datePublished": "2025-09-15T10:22:30.184Z",
    "dateReserved": "2025-08-15T16:15:40.630Z",
    "dateUpdated": "2025-09-15T12:24:41.138Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-9079 (GCVE-0-2025-9079)

Vulnerability from cvelistv5 – Published: 2025-09-19 19:22 – Updated: 2025-09-20 03:55

Title

Admin RCE via prepackaged plugins by way of misconfigured imports directory

Summary

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory

Severity ?

8 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

Mattermost

References

URL

Tags

https://mattermost.com/security-updates

Impacted products

	Vendor	Product	Version
	Mattermost	Mattermost	Affected: 10.8.0 , ≤ 10.8.3 (semver) Affected: 10.5.0 , ≤ 10.5.8 (semver) Affected: 9.11.0 , ≤ 9.11.17 (semver) Affected: 10.10.0 , ≤ 10.10.1 (semver) Affected: 10.9.0 , ≤ 10.9.3 (semver) Unaffected: 10.11.0 Unaffected: 10.8.4 Unaffected: 10.5.9 Unaffected: 9.11.18 Unaffected: 10.10.2 Unaffected: 10.9.4

Credits

daw10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9079",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-19T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-20T03:55:43.405Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mattermost",
          "vendor": "Mattermost",
          "versions": [
            {
              "lessThanOrEqual": "10.8.3",
              "status": "affected",
              "version": "10.8.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.5.8",
              "status": "affected",
              "version": "10.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.11.17",
              "status": "affected",
              "version": "9.11.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.10.1",
              "status": "affected",
              "version": "10.10.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.9.3",
              "status": "affected",
              "version": "10.9.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "10.11.0"
            },
            {
              "status": "unaffected",
              "version": "10.8.4"
            },
            {
              "status": "unaffected",
              "version": "10.5.9"
            },
            {
              "status": "unaffected",
              "version": "9.11.18"
            },
            {
              "status": "unaffected",
              "version": "10.10.2"
            },
            {
              "status": "unaffected",
              "version": "10.9.4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "daw10"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mattermost versions 10.8.x \u003c= 10.8.3, 10.5.x \u003c= 10.5.8, 9.11.x \u003c= 9.11.17, 10.10.x \u003c= 10.10.1, 10.9.x \u003c= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-19T19:22:00.288Z",
        "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "shortName": "Mattermost"
      },
      "references": [
        {
          "url": "https://mattermost.com/security-updates"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Mattermost to versions 10.11.0, 10.8.4, 10.5.9, 9.11.18, 10.10.2, 10.9.4 or higher."
        }
      ],
      "source": {
        "advisory": "MMSA-2025-00503",
        "defect": [
          "https://mattermost.atlassian.net/browse/MM-64674"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Admin RCE via prepackaged plugins by way of misconfigured imports directory"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
    "assignerShortName": "Mattermost",
    "cveId": "CVE-2025-9079",
    "datePublished": "2025-09-19T19:22:00.288Z",
    "dateReserved": "2025-08-15T15:42:04.648Z",
    "dateUpdated": "2025-09-20T03:55:43.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-9072 (GCVE-0-2025-9072)

Vulnerability from cvelistv5 – Published: 2025-09-15 10:28 – Updated: 2025-09-15 12:06

Title

One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter

Summary

Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user’s cookies to an attacker-controlled URL.

Severity ?

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

CWE

CWE-601 - CWE‑601: URL Redirection to Untrusted Site (“Open Redirect”)

Assigner

Mattermost

References

URL

Tags

https://mattermost.com/security-updates

Impacted products

	Vendor	Product	Version
	Mattermost	Mattermost	Affected: 10.10.0 , ≤ 10.10.1 (semver) Affected: 10.5.0 , ≤ 10.5.9 (semver) Affected: 10.9.0 , ≤ 10.9.4 (semver) Unaffected: 10.11.0 Unaffected: 10.10.2 Unaffected: 10.5.10 Unaffected: 10.9.5

Credits

DoyenSec

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9072",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-15T12:03:54.190037Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-15T12:06:57.518Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mattermost",
          "vendor": "Mattermost",
          "versions": [
            {
              "lessThanOrEqual": "10.10.1",
              "status": "affected",
              "version": "10.10.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.5.9",
              "status": "affected",
              "version": "10.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.9.4",
              "status": "affected",
              "version": "10.9.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "10.11.0"
            },
            {
              "status": "unaffected",
              "version": "10.10.2"
            },
            {
              "status": "unaffected",
              "version": "10.5.10"
            },
            {
              "status": "unaffected",
              "version": "10.9.5"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "DoyenSec"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mattermost versions 10.10.x \u003c= 10.10.1, 10.5.x \u003c= 10.5.9, 10.9.x \u003c= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user\u2019s cookies to an attacker-controlled URL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE\u2011601: URL Redirection to Untrusted Site (\u201cOpen Redirect\u201d)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T10:28:17.356Z",
        "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "shortName": "Mattermost"
      },
      "references": [
        {
          "url": "https://mattermost.com/security-updates"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Mattermost to versions 10.11.0, 10.10.2, 10.5.10, 10.9.5 or higher."
        }
      ],
      "source": {
        "advisory": "MMSA-2025-00509",
        "defect": [
          "https://mattermost.atlassian.net/browse/MM-64910"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
    "assignerShortName": "Mattermost",
    "cveId": "CVE-2025-9072",
    "datePublished": "2025-09-15T10:28:17.356Z",
    "dateReserved": "2025-08-15T14:59:12.540Z",
    "dateUpdated": "2025-09-15T12:06:57.518Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-9081 (GCVE-0-2025-9081)

Vulnerability from cvelistv5 – Published: 2025-09-19 19:36 – Updated: 2025-09-19 19:52

Title

IDOR in board file download allows any user to download any file by UUID

Summary

Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration

Severity ?

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

Mattermost

References

URL

Tags

https://mattermost.com/security-updates

Impacted products

	Vendor	Product	Version
	Mattermost	Mattermost	Affected: 10.5.0 , ≤ 10.5.8 (semver) Affected: 9.11.0 , ≤ 9.11.17 (semver) Unaffected: 10.11.0 Unaffected: 10.5.9 Unaffected: 9.11.18

Credits

daw10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9081",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-19T19:51:48.729159Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-19T19:52:03.664Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mattermost",
          "vendor": "Mattermost",
          "versions": [
            {
              "lessThanOrEqual": "10.5.8",
              "status": "affected",
              "version": "10.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.11.17",
              "status": "affected",
              "version": "9.11.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "10.11.0"
            },
            {
              "status": "unaffected",
              "version": "10.5.9"
            },
            {
              "status": "unaffected",
              "version": "9.11.18"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "daw10"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mattermost versions 10.5.x \u003c= 10.5.8, 9.11.x \u003c= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-19T19:36:14.702Z",
        "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "shortName": "Mattermost"
      },
      "references": [
        {
          "url": "https://mattermost.com/security-updates"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Mattermost to versions 10.11.0, 10.5.9, 9.11.18 or higher."
        }
      ],
      "source": {
        "advisory": "MMSA-2025-00502",
        "defect": [
          "https://mattermost.atlassian.net/browse/MM-64659"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "IDOR in board file download allows any user to download any file by UUID"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
    "assignerShortName": "Mattermost",
    "cveId": "CVE-2025-9081",
    "datePublished": "2025-09-19T19:36:14.702Z",
    "dateReserved": "2025-08-15T15:45:37.336Z",
    "dateUpdated": "2025-09-19T19:52:03.664Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-9076 (GCVE-0-2025-9076)

Vulnerability from cvelistv5 – Published: 2025-09-15 10:06 – Updated: 2025-09-15 14:05

Title

Mattermost Server exposes sensitive user credentials during shared channel membership synchronization

Summary

Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-862 - Missing Authorization

Assigner

Mattermost

References

URL

Tags

https://mattermost.com/security-updates

Impacted products

	Vendor	Product	Version
	Mattermost	Mattermost	Affected: 10.10.0 , ≤ 10.10.1 (semver) Unaffected: 10.11.0 Unaffected: 10.10.2

Credits

daw10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9076",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-15T14:05:07.348669Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-15T14:05:16.235Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mattermost",
          "vendor": "Mattermost",
          "versions": [
            {
              "lessThanOrEqual": "10.10.1",
              "status": "affected",
              "version": "10.10.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "10.11.0"
            },
            {
              "status": "unaffected",
              "version": "10.10.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "daw10"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mattermost versions 10.10.x \u003c= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T10:06:15.094Z",
        "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "shortName": "Mattermost"
      },
      "references": [
        {
          "url": "https://mattermost.com/security-updates"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Mattermost to versions 10.11.0, 10.10.2 or higher."
        }
      ],
      "source": {
        "advisory": "MMSA-2025-00513",
        "defect": [
          "https://mattermost.atlassian.net/browse/MM-64926"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Mattermost Server exposes sensitive user credentials during shared channel membership synchronization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
    "assignerShortName": "Mattermost",
    "cveId": "CVE-2025-9076",
    "datePublished": "2025-09-15T10:06:15.094Z",
    "dateReserved": "2025-08-15T15:26:17.148Z",
    "dateUpdated": "2025-09-15T14:05:16.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-9078 (GCVE-0-2025-9078)

Vulnerability from cvelistv5 – Published: 2025-09-15 10:10 – Updated: 2025-09-15 13:57

Title

Weak cache keys lead to post IDOR and link preview poisoning

Summary

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing

Severity ?

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-328 - Use of Weak Hash

Assigner

Mattermost

References

URL

Tags

https://mattermost.com/security-updates

Impacted products

	Vendor	Product	Version
	Mattermost	Mattermost	Affected: 10.8.0 , ≤ 10.8.3 (semver) Affected: 10.5.0 , ≤ 10.5.8 (semver) Affected: 9.11.0 , ≤ 9.11.17 (semver) Affected: 10.10.0 , ≤ 10.10.1 (semver) Affected: 10.9.0 , ≤ 10.9.3 (semver) Unaffected: 10.11.0 Unaffected: 10.8.4 Unaffected: 10.5.9 Unaffected: 9.11.18 Unaffected: 10.10.2 Unaffected: 10.9.4

Credits

daw10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9078",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-15T13:53:35.598807Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-15T13:57:49.086Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mattermost",
          "vendor": "Mattermost",
          "versions": [
            {
              "lessThanOrEqual": "10.8.3",
              "status": "affected",
              "version": "10.8.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.5.8",
              "status": "affected",
              "version": "10.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.11.17",
              "status": "affected",
              "version": "9.11.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.10.1",
              "status": "affected",
              "version": "10.10.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.9.3",
              "status": "affected",
              "version": "10.9.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "10.11.0"
            },
            {
              "status": "unaffected",
              "version": "10.8.4"
            },
            {
              "status": "unaffected",
              "version": "10.5.9"
            },
            {
              "status": "unaffected",
              "version": "9.11.18"
            },
            {
              "status": "unaffected",
              "version": "10.10.2"
            },
            {
              "status": "unaffected",
              "version": "10.9.4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "daw10"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mattermost versions 10.8.x \u003c= 10.8.3, 10.5.x \u003c= 10.5.8, 9.11.x \u003c= 9.11.17, 10.10.x \u003c= 10.10.1, 10.9.x \u003c= 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-328",
              "description": "CWE-328: Use of Weak Hash",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T10:10:06.886Z",
        "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "shortName": "Mattermost"
      },
      "references": [
        {
          "url": "https://mattermost.com/security-updates"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Mattermost to versions 10.11.0, 10.8.4, 10.5.9, 9.11.18, 10.10.2, 10.9.4 or higher."
        }
      ],
      "source": {
        "advisory": "MMSA-2025-00495",
        "defect": [
          "https://mattermost.atlassian.net/browse/MM-64449"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Weak cache keys lead to post IDOR and link preview poisoning"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
    "assignerShortName": "Mattermost",
    "cveId": "CVE-2025-9078",
    "datePublished": "2025-09-15T10:10:06.886Z",
    "dateReserved": "2025-08-15T15:34:54.442Z",
    "dateUpdated": "2025-09-15T13:57:49.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2025-1856

CVE-2025-9084 (GCVE-0-2025-9084)

CVE-2025-9079 (GCVE-0-2025-9079)

CVE-2025-9072 (GCVE-0-2025-9072)

CVE-2025-9081 (GCVE-0-2025-9081)

CVE-2025-9076 (GCVE-0-2025-9076)

CVE-2025-9078 (GCVE-0-2025-9078)

Tags

Sightings

Nomenclature