PT-2025-35709 · Webhook · Webhook

Asesidaa + 3 · Published 2025-09-03 · Updated 2025-09-03 · CVE-2025-9821

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions versions not specified

Description Users with webhook permissions can conduct Server-Side Request Forgery (SSRF) via webhooks. If they have permission to view the webhook logs, the partial request response is also disclosed. This allows bypassing firewalls to interact with internal services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-9821

GHSA-HJ6F-7HP7-XG69

Affected Products

Webhook

References · 9

• https://osv.dev/vulnerability/CVE-2025-9821 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hj6f-7hp7-xg69 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9821 · Security Note
• https://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69 · Note
• https://github.com/mautic/mautic · Note
• https://github.com/mautic/mautic/commit/6084f6de4c88d1aeb5f6c73ea4fe1b09c98ea52b · Note
• https://github.com/mautic/mautic/commit/dc5bb1466c9a48fd34768dc8ff5888716b2916ba · Note
• https://t.me/CVEtracker/31588 · Telegram Post
• https://twitter.com/CVEnew/status/1963204608467366174 · Twitter Post