« Volver al listado

CVE-2025-3228

Estado: AnalizadaMedia (4.3)—

Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly retrieve requestorInfo from playbooks handler for guest users which allows an attacker access to the playbook run.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mattermost — Mattermost Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-3228",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-3228",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-23T20:45:08.625535Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "responsibledisclosure@mattermost.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "responsibledisclosure@mattermost.com",
      "affectedData": [
        {
          "vendor": "Mattermost",
          "product": "Mattermost",
          "versions": [
            {
              "status": "affected",
              "version": "10.5.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.5.5"
            },
            {
              "status": "affected",
              "version": "9.11.0",
              "versionType": "semver",
              "lessThanOrEqual": "9.11.15"
            },
            {
              "status": "affected",
              "version": "10.8.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "10.7.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.7.2"
            },
            {
              "status": "affected",
              "version": "10.6.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.6.5"
            },
            {
              "status": "unaffected",
              "version": "10.9.0"
            },
            {
              "status": "unaffected",
              "version": "10.5.6"
            },
            {
              "status": "unaffected",
              "version": "9.11.16"
            },
            {
              "status": "unaffected",
              "version": "10.8.1"
            },
            {
              "status": "unaffected",
              "version": "10.7.3"
            },
            {
              "status": "unaffected",
              "version": "10.6.6"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-06-20T15:15:20.573",
  "references": [
    {
      "url": "https://mattermost.com/security-updates",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "responsibledisclosure@mattermost.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "responsibledisclosure@mattermost.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly retrieve requestorInfo from playbooks handler for guest users which allows an attacker access to the playbook run."
    },
    {
      "lang": "es",
      "value": "Las versiones de Mattermost 10.5.x &lt;= 10.5.5, 9.11.x &lt;= 9.11.15, 10.8.x &lt;= 10.8.0, 10.7.x &lt;= 10.7.2, 10.6.x &lt;= 10.6.5 no pueden recuperar correctamente requestorInfo del controlador de playbooks para usuarios invitados, lo que permite que un atacante acceda a la ejecución del playbook."
    }
  ],
  "lastModified": "2026-06-17T09:19:28.340",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9CEF0379-7E63-452C-8084-067092A25D92",
              "versionEndExcluding": "9.11.16",
              "versionStartIncluding": "9.11.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77EE1558-3E63-4178-90EB-DBC8F99B75AB",
              "versionEndExcluding": "10.5.6",
              "versionStartIncluding": "10.5.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E1A952E-F96B-4D50-B8FD-7CAFFE73263F",
              "versionEndExcluding": "10.6.6",
              "versionStartIncluding": "10.6.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28D55588-A52A-4ADD-AC90-A46BED4555A1",
              "versionEndExcluding": "10.7.3",
              "versionStartIncluding": "10.7.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:10.8.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "20DB174F-F76D-49F1-BB44-638A5FA71CDA"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:10.8.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51CA3B67-FE72-49C2-97EA-D7D86F3991EE"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:10.8.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C4DBC6F-061B-4844-9E80-596D4890DA2A"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:10.8.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA2C469A-7A94-4C55-9738-21C16B8C0817"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "responsibledisclosure@mattermost.com"
}