certfr_avis - certfr-2025-avi-0525

CERTFR-2025-AVI-0525

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans Mattermost Server. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Mattermost	Mattermost Server	Mattermost Server versions 9.11.x antérieures à 9.11.17
Mattermost	Mattermost Server	Mattermost Server versions 10.7.x antérieures à 10.7.4
Mattermost	Mattermost Server	Mattermost Server versions 10.5.x antérieures à 10.5.8
Mattermost	Mattermost Server	Mattermost Server versions 10.8.x antérieures à 10.8.2

References

Title

Publication Time

Tags

Bulletin de sécurité Mattermost MMSA-2025-00474	2025-06-18	vendor-advisory
Bulletin de sécurité Mattermost MMSA-2025-00494	2025-06-18	vendor-advisory
Bulletin de sécurité Mattermost MMSA-2025-00490	2025-06-18	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Mattermost Server versions 9.11.x ant\u00e9rieures \u00e0 9.11.17",
      "product": {
        "name": "Mattermost Server",
        "vendor": {
          "name": "Mattermost",
          "scada": false
        }
      }
    },
    {
      "description": "Mattermost Server versions 10.7.x ant\u00e9rieures \u00e0 10.7.4",
      "product": {
        "name": "Mattermost Server",
        "vendor": {
          "name": "Mattermost",
          "scada": false
        }
      }
    },
    {
      "description": "Mattermost Server versions 10.5.x ant\u00e9rieures \u00e0 10.5.8",
      "product": {
        "name": "Mattermost Server",
        "vendor": {
          "name": "Mattermost",
          "scada": false
        }
      }
    },
    {
      "description": "Mattermost Server versions 10.8.x ant\u00e9rieures \u00e0 10.8.2",
      "product": {
        "name": "Mattermost Server",
        "vendor": {
          "name": "Mattermost",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-6227",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6227"
    },
    {
      "name": "CVE-2025-6233",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6233"
    },
    {
      "name": "CVE-2025-6226",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6226"
    }
  ],
  "links": [],
  "reference": "CERTFR-2025-AVI-0525",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-06-19T00:00:00.000000"
    },
    {
      "description": "Ajout des r\u00e9f\u00e9rences CVE",
      "revision_date": "2025-08-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Mattermost Server. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Mattermost Server",
  "vendor_advisories": [
    {
      "published_at": "2025-06-18",
      "title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2025-00474",
      "url": "https://mattermost.com/security-updates/"
    },
    {
      "published_at": "2025-06-18",
      "title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2025-00494",
      "url": "https://mattermost.com/security-updates/"
    },
    {
      "published_at": "2025-06-18",
      "title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2025-00490",
      "url": "https://mattermost.com/security-updates/"
    }
  ]
}

CVE-2025-6226 (GCVE-0-2025-6226)

Vulnerability from cvelistv5 – Published: 2025-07-18 08:48 – Updated: 2025-08-07 09:53

Summary

Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

Mattermost

References

URL

Tags

https://mattermost.com/security-updates

Impacted products

	Vendor	Product	Version
	Mattermost	Mattermost	Affected: 10.5.0 , ≤ 10.5.6 (semver) Affected: 10.8.0 , ≤ 10.8.1 (semver) Affected: 10.7.0 , ≤ 10.7.3 (semver) Affected: 9.11.0 , ≤ 9.11.16 (semver) Unaffected: 10.9.0 Unaffected: 10.5.8 Unaffected: 10.8.2 Unaffected: 10.7.4 Unaffected: 9.11.17

Credits

Dawid Kulikowski (daw10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-6226",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-18T12:39:46.280328Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-18T12:46:21.941Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mattermost",
          "vendor": "Mattermost",
          "versions": [
            {
              "lessThanOrEqual": "10.5.6",
              "status": "affected",
              "version": "10.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.8.1",
              "status": "affected",
              "version": "10.8.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.7.3",
              "status": "affected",
              "version": "10.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.11.16",
              "status": "affected",
              "version": "9.11.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "10.9.0"
            },
            {
              "status": "unaffected",
              "version": "10.5.8"
            },
            {
              "status": "unaffected",
              "version": "10.8.2"
            },
            {
              "status": "unaffected",
              "version": "10.7.4"
            },
            {
              "status": "unaffected",
              "version": "9.11.17"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dawid Kulikowski (daw10)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mattermost versions 10.5.x \u003c= 10.5.6, 10.8.x \u003c= 10.8.1, 10.7.x \u003c= 10.7.3, 9.11.x \u003c= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don\u0027t have access to via guessing the PendingPostID of recently created posts."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-07T09:53:06.698Z",
        "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "shortName": "Mattermost"
      },
      "references": [
        {
          "url": "https://mattermost.com/security-updates"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Mattermost to versions 10.9.0, 10.5.7, 10.8.2, 10.7.4, 9.11.17 or higher."
        }
      ],
      "source": {
        "advisory": "MMSA-2025-00490",
        "defect": [
          "https://mattermost.atlassian.net/browse/MM-64225"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "IDOR in CreatePost API allows for timeboxed message disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
    "assignerShortName": "Mattermost",
    "cveId": "CVE-2025-6226",
    "datePublished": "2025-07-18T08:48:02.717Z",
    "dateReserved": "2025-06-18T10:41:12.541Z",
    "dateUpdated": "2025-08-07T09:53:06.698Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-6227 (GCVE-0-2025-6227)

Vulnerability from cvelistv5 – Published: 2025-07-18 11:39 – Updated: 2025-07-18 13:44

Summary

Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.

Severity ?

2.2 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-522 - Insufficiently Protected Credentials

Assigner

Mattermost

References

URL

Tags

https://mattermost.com/security-updates

Impacted products

	Vendor	Product	Version
	Mattermost	Mattermost	Affected: 10.5.0 , ≤ 10.5.7 (semver) Affected: 9.11.0 , ≤ 9.11.16 (semver) Unaffected: 10.9.0 Unaffected: 10.5.8 Unaffected: 9.11.17

Credits

Miguel de la Cruz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-6227",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-18T13:43:55.354516Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-18T13:44:00.998Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mattermost",
          "vendor": "Mattermost",
          "versions": [
            {
              "lessThanOrEqual": "10.5.7",
              "status": "affected",
              "version": "10.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.11.16",
              "status": "affected",
              "version": "9.11.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "10.9.0"
            },
            {
              "status": "unaffected",
              "version": "10.5.8"
            },
            {
              "status": "unaffected",
              "version": "9.11.17"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Miguel de la Cruz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mattermost versions 10.5.x \u003c= 10.5.7, 9.11.x \u003c= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-18T11:39:46.005Z",
        "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "shortName": "Mattermost"
      },
      "references": [
        {
          "url": "https://mattermost.com/security-updates"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Mattermost to versions 10.9.0, 10.5.8, 9.11.17 or higher."
        }
      ],
      "source": {
        "advisory": "MMSA-2025-00474",
        "defect": [
          "https://mattermost.atlassian.net/browse/MM-63931"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Invite token is used as part of the secure communication"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
    "assignerShortName": "Mattermost",
    "cveId": "CVE-2025-6227",
    "datePublished": "2025-07-18T11:39:46.005Z",
    "dateReserved": "2025-06-18T10:41:49.989Z",
    "dateUpdated": "2025-07-18T13:44:00.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-6233 (GCVE-0-2025-6233)

Vulnerability from cvelistv5 – Published: 2025-07-18 09:09 – Updated: 2025-07-18 12:30

Summary

Mattermost versions 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to sanitize input paths of file attachments in the bulk import JSONL file, which allows a system admin to read arbitrary system files via path traversal.

Severity ?

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

Mattermost

References

URL

Tags

https://mattermost.com/security-updates

Impacted products

	Vendor	Product	Version
	Mattermost	Mattermost	Affected: 10.8.0 , ≤ 10.8.1 (semver) Affected: 10.7.0 , ≤ 10.7.3 (semver) Affected: 10.5.0 , ≤ 10.5.7 (semver) Affected: 9.11.0 , ≤ 9.11.16 (semver) Unaffected: 10.9.0 Unaffected: 10.8.2 Unaffected: 10.7.4 Unaffected: 10.5.8 Unaffected: 9.11.17

Credits

Dawid Kulikowski (daw10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-6233",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-18T11:37:41.545711Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-18T12:30:35.494Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mattermost",
          "vendor": "Mattermost",
          "versions": [
            {
              "lessThanOrEqual": "10.8.1",
              "status": "affected",
              "version": "10.8.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.7.3",
              "status": "affected",
              "version": "10.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.5.7",
              "status": "affected",
              "version": "10.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.11.16",
              "status": "affected",
              "version": "9.11.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "10.9.0"
            },
            {
              "status": "unaffected",
              "version": "10.8.2"
            },
            {
              "status": "unaffected",
              "version": "10.7.4"
            },
            {
              "status": "unaffected",
              "version": "10.5.8"
            },
            {
              "status": "unaffected",
              "version": "9.11.17"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dawid Kulikowski (daw10)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mattermost versions 10.8.x \u003c= 10.8.1, 10.7.x \u003c= 10.7.3, 10.5.x \u003c= 10.5.7, 9.11.x \u003c= 9.11.16 fail to sanitize input paths of file attachments in the bulk import JSONL file, which allows a system admin to read arbitrary system files via path traversal."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-18T09:09:22.809Z",
        "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "shortName": "Mattermost"
      },
      "references": [
        {
          "url": "https://mattermost.com/security-updates"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Mattermost to versions 10.9.0, 10.8.2, 10.7.4, 10.5.8, 9.11.17 or higher."
        }
      ],
      "source": {
        "advisory": "MMSA-2025-00494",
        "defect": [
          "https://mattermost.atlassian.net/browse/MM-64401"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Arbitrary file read by system admin via path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
    "assignerShortName": "Mattermost",
    "cveId": "CVE-2025-6233",
    "datePublished": "2025-07-18T09:09:22.809Z",
    "dateReserved": "2025-06-18T13:06:31.030Z",
    "dateUpdated": "2025-07-18T12:30:35.494Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2025-AVI-0525

Solutions

CVE-2025-6226 (GCVE-0-2025-6226)

CVE-2025-6227 (GCVE-0-2025-6227)

CVE-2025-6233 (GCVE-0-2025-6233)

Tags

Sightings

Nomenclature