CVE-2025-20072CWE-704

Mobile crash via improper validation of proto style in attachments

Medium · published January 16, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

Mattermost Mobile versions <= 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the mobile via crafted malicious input.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00549 · 45.2th percentile
Weakness
CWE-704 · Incorrect Type Conversion or Cast
Published
2025-01-16T17:51Z
EPSS history
Timeline
  • 16 JAN 17:51Z
    Mobile crash via improper validation of proto style in attachments
    cvelistv5