PT-2025-4142 · Mattermost · Mattermost Mobile

C0Rydoras · Published 2025-01-16 · Updated 2025-01-18 · CVE-2025-20072

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mattermost Mobile versions <= 2.22.0

Description The issue allows an attacker to crash the mobile application via crafted malicious input. This is due to the failure to properly validate the style of proto supplied to an action's style in post.props.attachments.

Recommendations For Mattermost Mobile versions <= 2.22.0, update to a version greater than 2.22.0 to resolve the issue. As a temporary workaround, consider restricting the use of attachments in posts to minimize the risk of exploitation.

Fix

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

CVE-2025-20072

Affected Products

Mattermost Mobile

References · 6

• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20072 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20072 · Vendor Advisory
• https://twitter.com/CVEnew/status/1880625658889642324 · Twitter Post
• https://t.me/cvedetector/15591 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1880012594259296441 · Twitter Post