PT-2025-32583 · Mattermost · Mattermost Confluence Plugin

Lorenzo Gallegos · Published 2025-07-10 · Updated 2025-08-20 · CVE-2025-54525

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Mattermost Confluence Plugin versions prior to 1.5.0

Description: The Mattermost Confluence Plugin does not properly handle unexpected request bodies. This allows attackers to crash the plugin by repeatedly sending requests with invalid bodies to the channel subscription creation endpoint.

Recommendations: Update the Mattermost Confluence Plugin to version 1.5.0 or later.

Fix

DoS

Weakness Enumeration

CWE-1287

Related Identifiers

BDU:2025-09765

CVE-2025-54525

GHSA-3CG3-3MMR-W8HJ

GO-2025-3872

OPENSUSE-SU-2025:15469-1

Affected Products

Mattermost Confluence Plugin

References · 31

• https://osv.dev/vulnerability/openSUSE-SU-2025:15469-1 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09765 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54525 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3872 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3cg3-3mmr-w8hj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54525 · Security Note
• https://github.com/mattermost/mattermost-plugin-confluence · Note
• https://suse.com/security/cve/CVE-2025-52931 · Note
• https://suse.com/security/cve/CVE-2025-55196 · Note
• https://suse.com/security/cve/CVE-2025-55198 · Note
• https://suse.com/security/cve/CVE-2025-54525 · Note
• https://vuldb.com/?id.319478 · Note
• https://suse.com/security/cve/CVE-2025-54478 · Note
• https://twitter.com/CVEnew/status/1954985229996700085 · Twitter Post