PT-2025-17701 · Mattermost · Mattermost

Vultza · Published 2025-04-24 · Updated 2025-04-26 · CVE-2025-35965

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.11.x through 9.11.10 Mattermost versions 10.4.x through 10.4.2 Mattermost versions 10.5.x through 10.5.0

Description The issue arises from the failure to validate the uniqueness and quantity of task actions within the "UpdateRunTaskActions" GraphQL operation. This allows an attacker to create task items that contain an excessive number of actions triggered by specific posts, leading to a denial-of-service (DoS) condition by overloading the server.

Recommendations For versions 9.11.x through 9.11.10, update to a version that includes the fix for this issue. For versions 10.4.x through 10.4.2, update to a version that includes the fix for this issue. For versions 10.5.x through 10.5.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the "UpdateRunTaskActions" GraphQL operation to minimize the risk of exploitation.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-35965

GHSA-689C-XQ7X-XJWF

GO-2025-3643

OPENSUSE-SU-2025:15033-1

Affected Products

Mattermost

References · 19

• https://osv.dev/vulnerability/CVE-2025-35965 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-689c-xq7x-xjwf · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15033-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3643 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-35965 · Security Note
• https://github.com/mattermost/mattermost/commit/2b5275d87136f07e016c8eca09a2f004b31afc8a · Note
• https://github.com/mattermost/mattermost-plugin-playbooks · Note
• https://github.com/mattermost/mattermost-plugin-playbooks/commit/bf2633dad09f5768ce2bea4b7c5ffb74050052a8 · Note
• https://suse.com/security/cve/CVE-2025-35965 · Note
• https://t.me/cvedetector/23647 · Telegram Post
• https://suse.com/security/cve/CVE-2017-14992 · Note
• https://suse.com/security/cve/CVE-2017-9232 · Note
• https://suse.com/security/cve/CVE-2025-41423 · Note
• https://t.me/cvetracker/22259 · Telegram Post