CVE-2025-35965

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-35965", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2025-04-22T11:38:20.801Z", "datePublished": "2025-04-24T06:49:22.669Z", "dateUpdated": "2025-04-24T13:06:59.413Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "10.4.2", "status": "affected", "version": "10.4.0", "versionType": "semver"}, {"status": "affected", "version": "10.5.0"}, {"lessThanOrEqual": "9.11.10", "status": "affected", "version": "9.11.0", "versionType": "semver"}, {"status": "unaffected", "version": "10.6.0"}, {"status": "unaffected", "version": "10.4.3"}, {"status": "unaffected", "version": "10.5.1"}, {"status": "unaffected", "version": "9.11.11"}]}], "credits": [{"lang": "en", "type": "finder", "value": "vultza (vultza)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Mattermost versions 10.4.x &lt;= 10.4.2, 10.5.x &lt;= 10.5.0, 9.11.x &lt;= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.</p>"}], "value": "Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-04-24T06:49:22.669Z"}, "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update Mattermost to versions 10.6.0, 10.4.3, 10.5.1, 9.11.11 or higher. Alternatively, update the Mattermost Playbooks plugin to version 2.1.1 or higher.&nbsp;</p>"}], "value": "Update Mattermost to versions 10.6.0, 10.4.3, 10.5.1, 9.11.11 or higher. Alternatively, update the Mattermost Playbooks plugin to version 2.1.1 or higher."}], "source": {"advisory": "MMSA-2024-00391", "defect": ["https://mattermost.atlassian.net/browse/MM-61243"], "discovery": "EXTERNAL"}, "title": "DoS in Mattermost Playbooks via Excessive Task Actions", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-24T12:54:06.620657Z", "id": "CVE-2025-35965", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-24T13:06:59.413Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-35965", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-24T12:54:06.620657Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-24T13:04:02.271Z"}}], "cna": {"title": "DoS in Mattermost Playbooks via Excessive Task Actions", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-61243"], "advisory": "MMSA-2024-00391", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "vultza (vultza)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "10.4.0", "versionType": "semver", "lessThanOrEqual": "10.4.2"}, {"status": "affected", "version": "10.5.0"}, {"status": "affected", "version": "9.11.0", "versionType": "semver", "lessThanOrEqual": "9.11.10"}, {"status": "unaffected", "version": "10.6.0"}, {"status": "unaffected", "version": "10.4.3"}, {"status": "unaffected", "version": "10.5.1"}, {"status": "unaffected", "version": "9.11.11"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost to versions 10.6.0, 10.4.3, 10.5.1, 9.11.11 or higher. Alternatively, update the Mattermost Playbooks plugin to version 2.1.1 or higher.", "supportingMedia": [{"type": "text/html", "value": "<p>Update Mattermost to versions 10.6.0, 10.4.3, 10.5.1, 9.11.11 or higher. Alternatively, update the Mattermost Playbooks plugin to version 2.1.1 or higher.&nbsp;</p>", "base64": false}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.", "supportingMedia": [{"type": "text/html", "value": "<p>Mattermost versions 10.4.x &lt;= 10.4.2, 10.5.x &lt;= 10.5.0, 9.11.x &lt;= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-04-24T06:49:22.669Z"}}}, "cveMetadata": {"cveId": "CVE-2025-35965", "state": "PUBLISHED", "dateUpdated": "2025-04-24T13:06:59.413Z", "dateReserved": "2025-04-22T11:38:20.801Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2025-04-24T06:49:22.669Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "10.4.2", "status": "affected", "version": "10.4.0", "versionType": "semver"}, {"status": "affected", "version": "10.5.0"}, {"lessThanOrEqual": "9.11.10", "status": "affected", "version": "9.11.0", "versionType": "semver"}, {"status": "unaffected", "version": "10.6.0"}, {"status": "unaffected", "version": "10.4.3"}, {"status": "unaffected", "version": "10.5.1"}, {"status": "unaffected", "version": "9.11.11"}]}], "source": "responsibledisclosure@mattermost.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "0E0C9974-736C-4E66-B609-EA3F40E9304B", "versionEndExcluding": "9.11.11", "versionStartIncluding": "9.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "F2ACE54D-3EC6-4AC9-B243-35E8FFBE0EA0", "versionEndExcluding": "10.4.3", "versionStartIncluding": "10.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:10.5.0:-:*:*:*:*:*:*", "matchCriteriaId": "FCB473B7-939A-437C-9488-980523F2B043", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition."}, {"lang": "es", "value": "Las versiones de Mattermost 10.4.x &lt;= 10.4.2, 10.5.x &lt;= 10.5.0, 9.11.x &lt;= 9.11.10 no logran validar la singularidad y la cantidad de acciones de tareas dentro de la operaci\u00f3n GraphQL UpdateRunTaskActions, lo que permite a un atacante crear elementos de tarea que contienen una cantidad excesiva de acciones activadas por publicaciones espec\u00edficas, sobrecargando el servidor y provocando una condici\u00f3n de denegaci\u00f3n de servicio (DoS)."}], "id": "CVE-2025-35965", "lastModified": "2026-06-17T09:14:18.937", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-35965", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-24T12:54:06.620657Z", "version": "2.0.3"}}]}, "published": "2025-04-24T07:15:31.280", "references": [{"source": "responsibledisclosure@mattermost.com", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}], "sourceIdentifier": "responsibledisclosure@mattermost.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}]}

{}

{"created": "2025-07-13T11:06:43.821371+00:00", "updated": "2025-07-13T11:06:43.821459+00:00", "vendors": ["mattermost", "mattermost$PRODUCT$mattermost"]}