CVE-2025-21088CWE-704

WebApp crash via improper validation of proto style in attachments

Medium · published January 15, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the frontend via crafted malicious input.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00584 · 47.2th percentile
Weakness
CWE-704 · Incorrect Type Conversion or Cast
Published
2025-01-15T15:51Z
EPSS history
Timeline
  • 15 JAN 15:51Z
    WebApp crash via improper validation of proto style in attachments
    cvelistv5