CVE-2025-25274 - Vulnerability Details

Vendors	Products
Mattermost	Mattermost Server

Link	Providers
https://mattermost.com/security-updates

Type	Values Removed	Values Added
First Time appeared		Mattermost Mattermost mattermost Server
Weaknesses		CWE-77
CPEs		cpe:2.3:a:mattermost:mattermost_server::::::::
Vendors & Products		Mattermost Mattermost mattermost Server

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels.
Title		Unauthorized Command Execution in Archived Channels
Weaknesses		CWE-863
References		https://mattermost.com/security-updates
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-25274", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2025-03-20T08:20:28.196Z", "datePublished": "2025-03-21T08:24:13.165Z", "dateUpdated": "2025-03-21T17:27:56.172Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "10.4.2", "status": "affected", "version": "10.4.0", "versionType": "semver"}, {"lessThanOrEqual": "10.3.3", "status": "affected", "version": "10.3.0", "versionType": "semver"}, {"lessThanOrEqual": "9.11.8", "status": "affected", "version": "9.11.0", "versionType": "semver"}, {"status": "unaffected", "version": "10.5.0"}, {"status": "unaffected", "version": "10.4.3"}, {"status": "unaffected", "version": "10.3.4"}, {"status": "unaffected", "version": "9.11.9"}]}], "credits": [{"lang": "en", "type": "finder", "value": "hackit_bharat"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Mattermost versions 10.4.x &lt;= 10.4.2, 10.3.x &lt;= 10.3.3, 9.11.x &lt;= 9.11.8&nbsp;<span style=\"background-color: var(--wht);\">fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels.</span></p>"}], "value": "Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8\u00a0fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-03-21T08:24:13.165Z"}, "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update Mattermost to versions 10.5.0, 10.4.3, 10.3.4, 9.11.9 or higher.</p>"}], "value": "Update Mattermost to versions 10.5.0, 10.4.3, 10.3.4, 9.11.9 or higher."}], "source": {"advisory": "MMSA-2025-00421", "defect": ["https://mattermost.atlassian.net/browse/MM-62499"], "discovery": "EXTERNAL"}, "title": "Unauthorized Command Execution in Archived Channels", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-21T17:27:46.822244Z", "id": "CVE-2025-25274", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-21T17:27:56.172Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2025-25274 (string)

assignerOrgId : 9302f53e-dde5-4bf3-b2f2-a83f91ac0eee (string)

state : PUBLISHED (string)

assignerShortName : Mattermost (string)

dateReserved : 2025-03-20T08:20:28.196Z (string)

datePublished : 2025-03-21T08:24:13.165Z (string)

dateUpdated : 2025-03-21T17:27:56.172Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : Mattermost (string)

vendor : Mattermost (string)

versions : [ »

0 : { »

lessThanOrEqual : 10.4.2 (string)

status : affected (string)

version : 10.4.0 (string)

versionType : semver (string)

}

1 : { »

lessThanOrEqual : 10.3.3 (string)

status : affected (string)

version : 10.3.0 (string)

versionType : semver (string)

}

2 : { »

lessThanOrEqual : 9.11.8 (string)

status : affected (string)

version : 9.11.0 (string)

versionType : semver (string)

}

3 : { »

status : unaffected (string)

version : 10.5.0 (string)

}

4 : { »

status : unaffected (string)

version : 10.4.3 (string)

}

5 : { »

status : unaffected (string)

version : 10.3.4 (string)

}

6 : { »

status : unaffected (string)

version : 9.11.9 (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : hackit_bharat (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels. (string)

}

]

value : Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-863 (string)

description : CWE-863: Incorrect Authorization (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 9302f53e-dde5-4bf3-b2f2-a83f91ac0eee (string)

shortName : Mattermost (string)

dateUpdated : 2025-03-21T08:24:13.165Z (string)

}

references : [ »

0 : { »

url : https://mattermost.com/security-updates (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Update Mattermost to versions 10.5.0, 10.4.3, 10.3.4, 9.11.9 or higher. (string)

}

]

value : Update Mattermost to versions 10.5.0, 10.4.3, 10.3.4, 9.11.9 or higher. (string)

}

]

source : { »

advisory : MMSA-2025-00421 (string)

defect : [ »

0 : https://mattermost.atlassian.net/browse/MM-62499 (string)

]

discovery : EXTERNAL (string)

}

title : Unauthorized Command Execution in Archived Channels (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-03-21T17:27:46.822244Z (string)

id : CVE-2025-25274 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-21T17:27:56.172Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-25274", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-21T17:27:46.822244Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-21T17:27:52.781Z"}}], "cna": {"title": "Unauthorized Command Execution in Archived Channels", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-62499"], "advisory": "MMSA-2025-00421", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "hackit_bharat"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "10.4.0", "versionType": "semver", "lessThanOrEqual": "10.4.2"}, {"status": "affected", "version": "10.3.0", "versionType": "semver", "lessThanOrEqual": "10.3.3"}, {"status": "affected", "version": "9.11.0", "versionType": "semver", "lessThanOrEqual": "9.11.8"}, {"status": "unaffected", "version": "10.5.0"}, {"status": "unaffected", "version": "10.4.3"}, {"status": "unaffected", "version": "10.3.4"}, {"status": "unaffected", "version": "9.11.9"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost to versions 10.5.0, 10.4.3, 10.3.4, 9.11.9 or higher.", "supportingMedia": [{"type": "text/html", "value": "<p>Update Mattermost to versions 10.5.0, 10.4.3, 10.3.4, 9.11.9 or higher.</p>", "base64": false}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8\u00a0fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels.", "supportingMedia": [{"type": "text/html", "value": "<p>Mattermost versions 10.4.x &lt;= 10.4.2, 10.3.x &lt;= 10.3.3, 9.11.x &lt;= 9.11.8&nbsp;<span style=\"background-color: var(--wht);\">fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels.</span></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-03-21T08:24:13.165Z"}}}, "cveMetadata": {"cveId": "CVE-2025-25274", "state": "PUBLISHED", "dateUpdated": "2025-03-21T17:27:56.172Z", "dateReserved": "2025-03-20T08:20:28.196Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2025-03-21T08:24:13.165Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2025-25274 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-03-21T17:27:46.822244Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-21T17:27:52.781Z (string)

}

]

cna : { »

title : Unauthorized Command Execution in Archived Channels (string)

source : { »

defect : [ »

0 : https://mattermost.atlassian.net/browse/MM-62499 (string)

]

advisory : MMSA-2025-00421 (string)

discovery : EXTERNAL (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : hackit_bharat (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.3 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : LOW (string)

confidentialityImpact : NONE (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Mattermost (string)

product : Mattermost (string)

versions : [ »

0 : { »

status : affected (string)

version : 10.4.0 (string)

versionType : semver (string)

lessThanOrEqual : 10.4.2 (string)

}

1 : { »

status : affected (string)

version : 10.3.0 (string)

versionType : semver (string)

lessThanOrEqual : 10.3.3 (string)

}

2 : { »

status : affected (string)

version : 9.11.0 (string)

versionType : semver (string)

lessThanOrEqual : 9.11.8 (string)

}

3 : { »

status : unaffected (string)

version : 10.5.0 (string)

}

4 : { »

status : unaffected (string)

version : 10.4.3 (string)

}

5 : { »

status : unaffected (string)

version : 10.3.4 (string)

}

6 : { »

status : unaffected (string)

version : 9.11.9 (string)

}

]

defaultStatus : unaffected (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

value : Update Mattermost to versions 10.5.0, 10.4.3, 10.3.4, 9.11.9 or higher. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Update Mattermost to versions 10.5.0, 10.4.3, 10.3.4, 9.11.9 or higher. (string)

base64 : false (boolean)

}

]

}

]

references : [ »

0 : { »

url : https://mattermost.com/security-updates (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-863 (string)

description : CWE-863: Incorrect Authorization (string)

}

]

}

]

providerMetadata : { »

orgId : 9302f53e-dde5-4bf3-b2f2-a83f91ac0eee (string)

shortName : Mattermost (string)

dateUpdated : 2025-03-21T08:24:13.165Z (string)

}

cveMetadata : { »

cveId : CVE-2025-25274 (string)

state : PUBLISHED (string)

dateUpdated : 2025-03-21T17:27:56.172Z (string)

dateReserved : 2025-03-20T08:20:28.196Z (string)

assignerOrgId : 9302f53e-dde5-4bf3-b2f2-a83f91ac0eee (string)

datePublished : 2025-03-21T08:24:13.165Z (string)

assignerShortName : Mattermost (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "57EEC13C-37D1-4FAA-B956-AC335CACA543", "versionEndExcluding": "9.11.9", "versionStartIncluding": "9.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "30CC0EAB-1BB6-44B7-8529-968C2D710750", "versionEndExcluding": "10.3.4", "versionStartIncluding": "10.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "F2ACE54D-3EC6-4AC9-B243-35E8FFBE0EA0", "versionEndExcluding": "10.4.3", "versionStartIncluding": "10.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8\u00a0fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels."}, {"lang": "es", "value": "Las versiones de Mattermost 10.4.x &lt;= 10.4.2, 10.3.x &lt;= 10.3.3, 9.11.x &lt;= 9.11.8 no logran restringir la ejecuci\u00f3n de comandos en canales archivados, lo que permite que los usuarios autenticados ejecuten comandos en canales archivados."}], "id": "CVE-2025-25274", "lastModified": "2025-03-27T15:01:59.897", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-03-21T09:15:12.960", "references": [{"source": "responsibledisclosure@mattermost.com", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}], "sourceIdentifier": "responsibledisclosure@mattermost.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 57EEC13C-37D1-4FAA-B956-AC335CACA543 (string)

versionEndExcluding : 9.11.9 (string)

versionStartIncluding : 9.11.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 30CC0EAB-1BB6-44B7-8529-968C2D710750 (string)

versionEndExcluding : 10.3.4 (string)

versionStartIncluding : 10.3.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:* (string)

matchCriteriaId : F2ACE54D-3EC6-4AC9-B243-35E8FFBE0EA0 (string)

versionEndExcluding : 10.4.3 (string)

versionStartIncluding : 10.4.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels. (string)

}

1 : { »

lang : es (string)

value : Las versiones de Mattermost 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 no logran restringir la ejecución de comandos en canales archivados, lo que permite que los usuarios autenticados ejecuten comandos en canales archivados. (string)

}

]

id : CVE-2025-25274 (string)

lastModified : 2025-03-27T15:01:59.897 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : responsibledisclosure@mattermost.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 8.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2025-03-21T09:15:12.960 (string)

references : [ »

0 : { »

source : responsibledisclosure@mattermost.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://mattermost.com/security-updates (string)

}

]

sourceIdentifier : responsibledisclosure@mattermost.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-863 (string)

}

]

source : responsibledisclosure@mattermost.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-77 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object