CVE-2025-3228 in Mattermost

Sumário

de MITRE • 20/06/2025

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly retrieve requestorInfo from playbooks handler for guest users which allows an attacker access to the playbook run.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Responsável: Mattermost
• Reservar: 03/04/2025
• Divulgação: 20/06/2025
• Moderação: aceite
• Entrada: VDB-313430
• CPE: pronto
• CWE: CWE-863 (confirmado)
• CVSS: 4.3 (CNA)
• EPSS: 0.00251
• KEV: não
• Atividades: muito baixo
• Sector: Lawfirm, Hospital, ...

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-3228
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-3228
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-3228/