CVE-2025-24920 - Vulnerability Details

Vendors	Products
Mattermost	Mattermost Server

Link	Providers
https://mattermost.com/security-updates

Type	Values Removed	Values Added
First Time appeared		Mattermost Mattermost mattermost Server
CPEs		cpe:2.3:a:mattermost:mattermost_server::::::::
Vendors & Products		Mattermost Mattermost mattermost Server

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels
Title		Unauthorized Bookmark Creation and Modification in Archived Channels
Weaknesses		CWE-863
References		https://mattermost.com/security-updates
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-24920", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2025-03-20T08:20:28.187Z", "datePublished": "2025-03-21T08:25:44.676Z", "dateUpdated": "2025-03-21T12:28:00.367Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "10.4.2", "status": "affected", "version": "10.4.0", "versionType": "semver"}, {"lessThanOrEqual": "10.3.3", "status": "affected", "version": "10.3.0", "versionType": "semver"}, {"lessThanOrEqual": "9.11.8", "status": "affected", "version": "9.11.0", "versionType": "semver"}, {"status": "affected", "version": "10.5.0"}, {"status": "unaffected", "version": "10.6.0"}, {"status": "unaffected", "version": "10.4.3"}, {"status": "unaffected", "version": "10.3.4"}, {"status": "unaffected", "version": "9.11.9"}, {"status": "unaffected", "version": "10.5.1"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Caleb Roseland"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Mattermost versions 10.4.x &lt;= 10.4.2, 10.3.x &lt;= 10.3.3, 9.11.x &lt;= 9.11.8, 10.5.x &lt;= 10.5.0&nbsp;fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels</p>"}], "value": "Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0\u00a0fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-03-21T08:25:44.676Z"}, "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update Mattermost to versions 10.6.0, 10.4.3, 10.3.4, 9.11.9, 10.5.1 or higher.</p>"}], "value": "Update Mattermost to versions 10.6.0, 10.4.3, 10.3.4, 9.11.9, 10.5.1 or higher."}], "source": {"advisory": "MMSA-2025-00432", "defect": ["https://mattermost.atlassian.net/browse/MM-62688"], "discovery": "EXTERNAL"}, "title": "Unauthorized Bookmark Creation and Modification in Archived Channels", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-21T12:26:24.639447Z", "id": "CVE-2025-24920", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-21T12:28:00.367Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2025-24920 (string)

assignerOrgId : 9302f53e-dde5-4bf3-b2f2-a83f91ac0eee (string)

state : PUBLISHED (string)

assignerShortName : Mattermost (string)

dateReserved : 2025-03-20T08:20:28.187Z (string)

datePublished : 2025-03-21T08:25:44.676Z (string)

dateUpdated : 2025-03-21T12:28:00.367Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : Mattermost (string)

vendor : Mattermost (string)

versions : [ »

0 : { »

lessThanOrEqual : 10.4.2 (string)

status : affected (string)

version : 10.4.0 (string)

versionType : semver (string)

}

1 : { »

lessThanOrEqual : 10.3.3 (string)

status : affected (string)

version : 10.3.0 (string)

versionType : semver (string)

}

2 : { »

lessThanOrEqual : 9.11.8 (string)

status : affected (string)

version : 9.11.0 (string)

versionType : semver (string)

}

3 : { »

status : affected (string)

version : 10.5.0 (string)

}

4 : { »

status : unaffected (string)

version : 10.6.0 (string)

}

5 : { »

status : unaffected (string)

version : 10.4.3 (string)

}

6 : { »

status : unaffected (string)

version : 10.3.4 (string)

}

7 : { »

status : unaffected (string)

version : 9.11.9 (string)

}

8 : { »

status : unaffected (string)

version : 10.5.1 (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Caleb Roseland (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels (string)

}

]

value : Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-863 (string)

description : CWE-863: Incorrect Authorization (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 9302f53e-dde5-4bf3-b2f2-a83f91ac0eee (string)

shortName : Mattermost (string)

dateUpdated : 2025-03-21T08:25:44.676Z (string)

}

references : [ »

0 : { »

url : https://mattermost.com/security-updates (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Update Mattermost to versions 10.6.0, 10.4.3, 10.3.4, 9.11.9, 10.5.1 or higher. (string)

}

]

value : Update Mattermost to versions 10.6.0, 10.4.3, 10.3.4, 9.11.9, 10.5.1 or higher. (string)

}

]

source : { »

advisory : MMSA-2025-00432 (string)

defect : [ »

0 : https://mattermost.atlassian.net/browse/MM-62688 (string)

]

discovery : EXTERNAL (string)

}

title : Unauthorized Bookmark Creation and Modification in Archived Channels (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-03-21T12:26:24.639447Z (string)

id : CVE-2025-24920 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-21T12:28:00.367Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-24920", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-21T12:26:24.639447Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-21T12:27:54.979Z"}}], "cna": {"title": "Unauthorized Bookmark Creation and Modification in Archived Channels", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-62688"], "advisory": "MMSA-2025-00432", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Caleb Roseland"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "10.4.0", "versionType": "semver", "lessThanOrEqual": "10.4.2"}, {"status": "affected", "version": "10.3.0", "versionType": "semver", "lessThanOrEqual": "10.3.3"}, {"status": "affected", "version": "9.11.0", "versionType": "semver", "lessThanOrEqual": "9.11.8"}, {"status": "affected", "version": "10.5.0"}, {"status": "unaffected", "version": "10.6.0"}, {"status": "unaffected", "version": "10.4.3"}, {"status": "unaffected", "version": "10.3.4"}, {"status": "unaffected", "version": "9.11.9"}, {"status": "unaffected", "version": "10.5.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost to versions 10.6.0, 10.4.3, 10.3.4, 9.11.9, 10.5.1 or higher.", "supportingMedia": [{"type": "text/html", "value": "<p>Update Mattermost to versions 10.6.0, 10.4.3, 10.3.4, 9.11.9, 10.5.1 or higher.</p>", "base64": false}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0\u00a0fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels", "supportingMedia": [{"type": "text/html", "value": "<p>Mattermost versions 10.4.x &lt;= 10.4.2, 10.3.x &lt;= 10.3.3, 9.11.x &lt;= 9.11.8, 10.5.x &lt;= 10.5.0&nbsp;fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-03-21T08:25:44.676Z"}}}, "cveMetadata": {"cveId": "CVE-2025-24920", "state": "PUBLISHED", "dateUpdated": "2025-03-21T12:28:00.367Z", "dateReserved": "2025-03-20T08:20:28.187Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2025-03-21T08:25:44.676Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2025-24920 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-03-21T12:26:24.639447Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-21T12:27:54.979Z (string)

}

]

cna : { »

title : Unauthorized Bookmark Creation and Modification in Archived Channels (string)

source : { »

defect : [ »

0 : https://mattermost.atlassian.net/browse/MM-62688 (string)

]

advisory : MMSA-2025-00432 (string)

discovery : EXTERNAL (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Caleb Roseland (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.3 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : LOW (string)

confidentialityImpact : NONE (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Mattermost (string)

product : Mattermost (string)

versions : [ »

0 : { »

status : affected (string)

version : 10.4.0 (string)

versionType : semver (string)

lessThanOrEqual : 10.4.2 (string)

}

1 : { »

status : affected (string)

version : 10.3.0 (string)

versionType : semver (string)

lessThanOrEqual : 10.3.3 (string)

}

2 : { »

status : affected (string)

version : 9.11.0 (string)

versionType : semver (string)

lessThanOrEqual : 9.11.8 (string)

}

3 : { »

status : affected (string)

version : 10.5.0 (string)

}

4 : { »

status : unaffected (string)

version : 10.6.0 (string)

}

5 : { »

status : unaffected (string)

version : 10.4.3 (string)

}

6 : { »

status : unaffected (string)

version : 10.3.4 (string)

}

7 : { »

status : unaffected (string)

version : 9.11.9 (string)

}

8 : { »

status : unaffected (string)

version : 10.5.1 (string)

}

]

defaultStatus : unaffected (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

value : Update Mattermost to versions 10.6.0, 10.4.3, 10.3.4, 9.11.9, 10.5.1 or higher. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Update Mattermost to versions 10.6.0, 10.4.3, 10.3.4, 9.11.9, 10.5.1 or higher. (string)

base64 : false (boolean)

}

]

}

]

references : [ »

0 : { »

url : https://mattermost.com/security-updates (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-863 (string)

description : CWE-863: Incorrect Authorization (string)

}

]

}

]

providerMetadata : { »

orgId : 9302f53e-dde5-4bf3-b2f2-a83f91ac0eee (string)

shortName : Mattermost (string)

dateUpdated : 2025-03-21T08:25:44.676Z (string)

}

cveMetadata : { »

cveId : CVE-2025-24920 (string)

state : PUBLISHED (string)

dateUpdated : 2025-03-21T12:28:00.367Z (string)

dateReserved : 2025-03-20T08:20:28.187Z (string)

assignerOrgId : 9302f53e-dde5-4bf3-b2f2-a83f91ac0eee (string)

datePublished : 2025-03-21T08:25:44.676Z (string)

assignerShortName : Mattermost (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "57EEC13C-37D1-4FAA-B956-AC335CACA543", "versionEndExcluding": "9.11.9", "versionStartIncluding": "9.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "30CC0EAB-1BB6-44B7-8529-968C2D710750", "versionEndExcluding": "10.3.4", "versionStartIncluding": "10.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "F2ACE54D-3EC6-4AC9-B243-35E8FFBE0EA0", "versionEndExcluding": "10.4.3", "versionStartIncluding": "10.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "6E8D69BD-C81D-4B1D-BA8B-AC84DEB30208", "versionEndExcluding": "10.5.1", "versionStartIncluding": "10.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0\u00a0fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels"}, {"lang": "es", "value": "Las versiones de Mattermost 10.4.x &lt;= 10.4.2, 10.3.x &lt;= 10.3.3, 9.11.x &lt;= 9.11.8, 10.5.x &lt;= 10.5.0 no restringen la creaci\u00f3n y actualizaci\u00f3n de marcadores en canales archivados, lo que permite que los usuarios autenticados creen o actualicen marcadores en canales archivados."}], "id": "CVE-2025-24920", "lastModified": "2025-03-27T14:10:53.500", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-03-21T09:15:12.633", "references": [{"source": "responsibledisclosure@mattermost.com", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}], "sourceIdentifier": "responsibledisclosure@mattermost.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-863"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 57EEC13C-37D1-4FAA-B956-AC335CACA543 (string)

versionEndExcluding : 9.11.9 (string)

versionStartIncluding : 9.11.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 30CC0EAB-1BB6-44B7-8529-968C2D710750 (string)

versionEndExcluding : 10.3.4 (string)

versionStartIncluding : 10.3.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:* (string)

matchCriteriaId : F2ACE54D-3EC6-4AC9-B243-35E8FFBE0EA0 (string)

versionEndExcluding : 10.4.3 (string)

versionStartIncluding : 10.4.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 6E8D69BD-C81D-4B1D-BA8B-AC84DEB30208 (string)

versionEndExcluding : 10.5.1 (string)

versionStartIncluding : 10.5.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels (string)

}

1 : { »

lang : es (string)

value : Las versiones de Mattermost 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 no restringen la creación y actualización de marcadores en canales archivados, lo que permite que los usuarios autenticados creen o actualicen marcadores en canales archivados. (string)

}

]

id : CVE-2025-24920 (string)

lastModified : 2025-03-27T14:10:53.500 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : responsibledisclosure@mattermost.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2025-03-21T09:15:12.633 (string)

references : [ »

0 : { »

source : responsibledisclosure@mattermost.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://mattermost.com/security-updates (string)

}

]

sourceIdentifier : responsibledisclosure@mattermost.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-863 (string)

}

]

source : responsibledisclosure@mattermost.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-863 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object