CVE-2025-22445
published 2025-01-09CVE-2025-22445: Mattermost versions 10.x <= 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive…
PriorityP427medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.32%
24.1th percentile
Mattermost versions 10.x <= 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 0 < 10.3.0+incompatible | 10.3.0+incompatible |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.0.0-20250102081831-64c566a8280b | 8.0.0-20250102081831-64c566a8280b |
| github.com | mattermost_mattermost_server_v8 | >= 10.0 < 10.3.0 | 10.3.0 |
| mattermost | mattermost | 10.0.* – 10.2.* | — |
| mattermost | mattermost_server | >= 10.0.0 < 10.3.0 | 10.3.0 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vendor_redhat3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-server
osv·2025-01-09
CVE-2025-22445 Mattermost has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-server
Mattermost has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-server
Mattermost has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-server.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: .
OSV
Mattermost has Improper Check for Unusual or Exceptional Conditions
osv·2025-01-09
CVE-2025-22445 [LOW] Mattermost has Improper Check for Unusual or Exceptional Conditions
Mattermost has Improper Check for Unusual or Exceptional Conditions
Mattermost versions 10.x <= 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting.
GHSA
Mattermost has Improper Check for Unusual or Exceptional Conditions
ghsa·2025-01-09
CVE-2025-22445 [LOW] CWE-754 Mattermost has Improper Check for Unusual or Exceptional Conditions
Mattermost has Improper Check for Unusual or Exceptional Conditions
Mattermost versions 10.x <= 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting.
Red Hat
mattermost: Misleading UI for undefined admin console settings in Calls causes security confusion
vendor_redhat·2025-01-09·CVSS 3.5
CVE-2025-22445 [LOW] CWE-754 mattermost: Misleading UI for undefined admin console settings in Calls causes security confusion
mattermost: Misleading UI for undefined admin console settings in Calls causes security confusion
Mattermost versions 10.x <= 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting.
A flaw was found in Mattermost. In certain versions, Mattermost fails to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting.
Package: rhacm2/acm-grafana-rhel8 (Red Hat Advanced Cluster Management for Kubernetes 2) - Not affected
Package: advanced-cluster-security/rhacs-central-db-rhel8 (Red Hat Advanced Cluster Security 4) - Not affected
Package: advanced-cluster-security/rhacs-main-rhel8 (Red Hat Advance
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-01-09
Published