CVE-2025-54463 - Vulnerability Details - OpenCVE

ReportizFlow

Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Mattermost	Confluence Mattermost

Configuration 1 [-]

cpe:2.3:a:mattermost:confluence:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://mattermost.com/security-updates

History

Wed, 24 Sep 2025 00:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mattermost confluence
CPEs		cpe:2.3:a:mattermost:confluence::::::::
Vendors & Products		Mattermost confluence

Tue, 12 Aug 2025 12:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mattermost Mattermost mattermost
Vendors & Products		Mattermost Mattermost mattermost

Mon, 11 Aug 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 11 Aug 2025 19:15:00 +0000

Type	Values Removed	Values Added
Description		Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body.
Title		Unexpected Input to Cloud Webhook endpoint Causes DoS in Mattermost Confluence Plugin
Weaknesses		CWE-754
References		https://mattermost.com/security-updates
Metrics		cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Mattermost

Published: 2025-08-11T18:57:05.342Z

Updated: 2025-08-11T19:39:08.495Z

Reserved: 2025-07-28T14:26:12.399Z

Link: CVE-2025-54463

Vulnrichment

Updated: 2025-08-11T19:39:00.688Z

NVD

Status : Analyzed

Published: 2025-08-11T19:15:30.080

Modified: 2025-09-24T00:42:37.833

Link: CVE-2025-54463

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-54463", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2025-07-28T14:26:12.399Z", "datePublished": "2025-08-11T18:57:05.342Z", "dateUpdated": "2025-08-11T19:39:08.495Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost Confluence Plugin", "vendor": "Mattermost", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThan": "1.5.0"}, {"version": "1.5.0", "status": "unaffected"}], "repo": "https://github.com/mattermost/mattermost-plugin-confluence/"}], "credits": [{"lang": "en", "type": "finder", "value": "Lorenzo Gallegos"}], "descriptions": [{"lang": "en", "value": "Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body."}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseSeverity": "MEDIUM", "baseScore": 5.9}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions", "cweId": "CWE-754"}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"value": "Update Mattermost Confluence Plugin to version 1.5.0 or higher.", "lang": "en"}], "source": {"advisory": "MMSA-2025-00477", "defect": ["https://mattermost.atlassian.net/browse/MM-64149"], "discovery": "{\"self\"=>\"https://mattermost.atlassian.net/rest/api/2/customFieldOption/10557\", \"value\"=>\"Internal\", \"id\"=>\"10557\"}"}, "title": "Unexpected Input to Cloud Webhook endpoint Causes DoS in Mattermost Confluence Plugin", "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-08-11T18:57:05.342Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-11T19:38:38.135640Z", "id": "CVE-2025-54463", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-11T19:39:08.495Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-54463", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-11T19:38:38.135640Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-11T19:39:00.688Z"}}], "cna": {"title": "Unexpected Input to Cloud Webhook endpoint Causes DoS in Mattermost Confluence Plugin", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-64149"], "advisory": "MMSA-2025-00477", "discovery": "{\"self\"=>\"https://mattermost.atlassian.net/rest/api/2/customFieldOption/10557\", \"value\"=>\"Internal\", \"id\"=>\"10557\"}"}, "credits": [{"lang": "en", "type": "finder", "value": "Lorenzo Gallegos"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/mattermost/mattermost-plugin-confluence/", "vendor": "Mattermost", "product": "Mattermost Confluence Plugin", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.0", "versionType": "semver"}, {"status": "unaffected", "version": "1.5.0"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost Confluence Plugin to version 1.5.0 or higher."}], "references": [{"url": "https://mattermost.com/security-updates"}], "descriptions": [{"lang": "en", "value": "Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-754", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-08-11T18:57:05.342Z"}}}, "cveMetadata": {"cveId": "CVE-2025-54463", "state": "PUBLISHED", "dateUpdated": "2025-08-11T19:39:08.495Z", "dateReserved": "2025-07-28T14:26:12.399Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2025-08-11T18:57:05.342Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.1"}