From 93f44c4f1fe87df94c299ee2d020bb8d18ef09e7 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 24 Apr 2025 16:10:48 +0000 Subject: [PATCH] Publish Advisories GHSA-3g36-gf7c-75qw GHSA-689c-xq7x-xjwf GHSA-fr22-5377-f3p7 GHSA-3g36-gf7c-75qw GHSA-689c-xq7x-xjwf GHSA-fr22-5377-f3p7 --- .../GHSA-3g36-gf7c-75qw.json | 164 ++++++++++++++++++ .../GHSA-689c-xq7x-xjwf.json | 164 ++++++++++++++++++ .../GHSA-fr22-5377-f3p7.json | 164 ++++++++++++++++++ .../GHSA-3g36-gf7c-75qw.json | 36 ---- .../GHSA-689c-xq7x-xjwf.json | 36 ---- .../GHSA-fr22-5377-f3p7.json | 36 ---- 6 files changed, 492 insertions(+), 108 deletions(-) create mode 100644 advisories/github-reviewed/2025/04/GHSA-3g36-gf7c-75qw/GHSA-3g36-gf7c-75qw.json create mode 100644 advisories/github-reviewed/2025/04/GHSA-689c-xq7x-xjwf/GHSA-689c-xq7x-xjwf.json create mode 100644 advisories/github-reviewed/2025/04/GHSA-fr22-5377-f3p7/GHSA-fr22-5377-f3p7.json delete mode 100644 advisories/unreviewed/2025/04/GHSA-3g36-gf7c-75qw/GHSA-3g36-gf7c-75qw.json delete mode 100644 advisories/unreviewed/2025/04/GHSA-689c-xq7x-xjwf/GHSA-689c-xq7x-xjwf.json delete mode 100644 advisories/unreviewed/2025/04/GHSA-fr22-5377-f3p7/GHSA-fr22-5377-f3p7.json diff --git a/advisories/github-reviewed/2025/04/GHSA-3g36-gf7c-75qw/GHSA-3g36-gf7c-75qw.json b/advisories/github-reviewed/2025/04/GHSA-3g36-gf7c-75qw/GHSA-3g36-gf7c-75qw.json new file mode 100644 index 00000000000..2979fd15b0e --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-3g36-gf7c-75qw/GHSA-3g36-gf7c-75qw.json @@ -0,0 +1,164 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3g36-gf7c-75qw", + "modified": "2025-04-24T16:09:27Z", + "published": "2025-04-24T09:30:33Z", + "aliases": [ + "CVE-2025-41395" + ], + "summary": "Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type", + "details": "Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost-plugin-playbooks" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 2.1.1" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0-20250218121836-2b5275d87136" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.4.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 10.4.3" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.5.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 10.5.1" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.11.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 9.11.11" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost-plugin-playbooks" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.41.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41395" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost-plugin-playbooks/commit/4c823090e281cb9c0d5c17ee2e5db275117540d1" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost/commit/2b5275d87136f07e016c8eca09a2f004b31afc8a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost-plugin-playbooks" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1287" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-24T16:09:27Z", + "nvd_published_at": "2025-04-24T07:15:31Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-689c-xq7x-xjwf/GHSA-689c-xq7x-xjwf.json b/advisories/github-reviewed/2025/04/GHSA-689c-xq7x-xjwf/GHSA-689c-xq7x-xjwf.json new file mode 100644 index 00000000000..16020a91074 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-689c-xq7x-xjwf/GHSA-689c-xq7x-xjwf.json @@ -0,0 +1,164 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-689c-xq7x-xjwf", + "modified": "2025-04-24T16:09:19Z", + "published": "2025-04-24T09:30:33Z", + "aliases": [ + "CVE-2025-35965" + ], + "summary": "Mattermost Playbooks fails to validate the uniqueness and quantity of task actions", + "details": "Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0-20250218121836-2b5275d87136" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost-plugin-playbooks" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 2.1.1" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.4.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 10.4.3" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.5.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 10.5.1" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.11.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 9.11.11" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost-plugin-playbooks" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.41.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35965" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost-plugin-playbooks/commit/bf2633dad09f5768ce2bea4b7c5ffb74050052a8" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost/commit/2b5275d87136f07e016c8eca09a2f004b31afc8a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost-plugin-playbooks" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-24T16:09:18Z", + "nvd_published_at": "2025-04-24T07:15:31Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-fr22-5377-f3p7/GHSA-fr22-5377-f3p7.json b/advisories/github-reviewed/2025/04/GHSA-fr22-5377-f3p7/GHSA-fr22-5377-f3p7.json new file mode 100644 index 00000000000..83910c14b03 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-fr22-5377-f3p7/GHSA-fr22-5377-f3p7.json @@ -0,0 +1,164 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fr22-5377-f3p7", + "modified": "2025-04-24T16:09:31Z", + "published": "2025-04-24T09:30:33Z", + "aliases": [ + "CVE-2025-41423" + ], + "summary": "Mattermost Playbooks fails to properly validate permissions", + "details": "Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost-plugin-playbooks" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 2.1.1" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost-plugin-playbooks" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.41.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0-20250218121836-2b5275d87136" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.4.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 10.4.3" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.5.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 10.5.1" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.11.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 9.11.11" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41423" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost-plugin-playbooks/commit/f9f7064e4d9f3918d66bac1f5f9eb28f0723464b" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost/commit/2b5275d87136f07e016c8eca09a2f004b31afc8a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost-plugin-playbooks" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-04-24T16:09:31Z", + "nvd_published_at": "2025-04-24T07:15:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-3g36-gf7c-75qw/GHSA-3g36-gf7c-75qw.json b/advisories/unreviewed/2025/04/GHSA-3g36-gf7c-75qw/GHSA-3g36-gf7c-75qw.json deleted file mode 100644 index 5f7e674d16d..00000000000 --- a/advisories/unreviewed/2025/04/GHSA-3g36-gf7c-75qw/GHSA-3g36-gf7c-75qw.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-3g36-gf7c-75qw", - "modified": "2025-04-24T09:30:33Z", - "published": "2025-04-24T09:30:33Z", - "aliases": [ - "CVE-2025-41395" - ], - "details": "Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41395" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-1287" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-04-24T07:15:31Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-689c-xq7x-xjwf/GHSA-689c-xq7x-xjwf.json b/advisories/unreviewed/2025/04/GHSA-689c-xq7x-xjwf/GHSA-689c-xq7x-xjwf.json deleted file mode 100644 index d0291d6b9df..00000000000 --- a/advisories/unreviewed/2025/04/GHSA-689c-xq7x-xjwf/GHSA-689c-xq7x-xjwf.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-689c-xq7x-xjwf", - "modified": "2025-04-24T09:30:33Z", - "published": "2025-04-24T09:30:33Z", - "aliases": [ - "CVE-2025-35965" - ], - "details": "Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35965" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-770" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-04-24T07:15:31Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-fr22-5377-f3p7/GHSA-fr22-5377-f3p7.json b/advisories/unreviewed/2025/04/GHSA-fr22-5377-f3p7/GHSA-fr22-5377-f3p7.json deleted file mode 100644 index 787cdb4e50b..00000000000 --- a/advisories/unreviewed/2025/04/GHSA-fr22-5377-f3p7/GHSA-fr22-5377-f3p7.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-fr22-5377-f3p7", - "modified": "2025-04-24T09:30:33Z", - "published": "2025-04-24T09:30:33Z", - "aliases": [ - "CVE-2025-41423" - ], - "details": "Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41423" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-863" - ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-04-24T07:15:31Z" - } -} \ No newline at end of file