PT-2025-17702 · Mattermost · Mattermost

C0Rydoras · Published 2025-04-24 · Updated 2025-04-26 · CVE-2025-41395

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.11.x through 9.11.10 Mattermost versions 10.4.x through 10.4.2 Mattermost versions 10.5.x through 10.5.0

Description The issue arises from the failure to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin. This allows an attacker to create a specially crafted post with maliciously crafted props, causing a denial of service (DoS) of the web app for all users.

Recommendations For versions 9.11.x through 9.11.10, update to a version later than 9.11.10 to resolve the issue. For versions 10.4.x through 10.4.2, update to a version later than 10.4.2 to resolve the issue. For versions 10.5.x through 10.5.0, update to a version later than 10.5.0 to resolve the issue. As a temporary workaround, consider disabling the RetrospectivePost custom post type in the Playbooks plugin until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-1287

Related Identifiers

CVE-2025-41395

GHSA-3G36-GF7C-75QW

GO-2025-3642

OPENSUSE-SU-2025:15033-1

Affected Products

Mattermost

References · 19

• https://osv.dev/vulnerability/GO-2025-3642 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-41395 · Security Note
• https://osv.dev/vulnerability/GHSA-3g36-gf7c-75qw · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15033-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-41395 · Vendor Advisory
• https://github.com/mattermost/mattermost/commit/2b5275d87136f07e016c8eca09a2f004b31afc8a · Note
• https://github.com/mattermost/mattermost-plugin-playbooks · Note
• https://github.com/mattermost/mattermost-plugin-playbooks/commit/4c823090e281cb9c0d5c17ee2e5db275117540d1 · Note
• https://suse.com/security/cve/CVE-2025-35965 · Note
• https://twitter.com/CVEnew/status/1915303685405487482 · Twitter Post
• https://github.com/advisories/GHSA-3g36-gf7c-75qw · Note
• https://suse.com/security/cve/CVE-2017-14992 · Note
• https://suse.com/security/cve/CVE-2017-9232 · Note
• https://suse.com/security/cve/CVE-2025-41423 · Note