CVE-2025-54525highCWE-1287

CVE-2025-54525: falha de alta gravidade em Mattermost Confluence Plugin

Unexpected input to Create Channel Subscription endpoint causes DoS in Mattermost Confluence Plugin

Publicada em

Seguir esta CVE+ Monitorar Mattermost Confluence Plugin+ Monitorar github.com/mattermost/mattermost-plugin-confluence

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.4%
Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to create channel subscription endpoint with an invalid request body.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Mattermost · Mattermost Confluence Plugin
CVEs relacionadas — Mattermost Confluence Plugin

No mesmo produto, das mais perigosas para as menos.

CVE-2025-52931HIGHUnexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence PluginEPSS 0.4%CVE-2025-54463MEDIUMUnexpected Input to Cloud Webhook endpoint Causes DoS in Mattermost Confluence PluginEPSS 0.3%CVE-2025-53514MEDIUMUnexpected Input to Server Webhook endpoint Causes DoS in Mattermost Confluence PluginEPSS 0.3%CVE-2025-49221LOWUnauthenticated Access to Channel Subscription in Mattermost Confluence PluginEPSS 0.3%CVE-2025-54478HIGHUnauthenticated Channel Subscription Edit in Mattermost Confluence PluginEPSS 0.3%CVE-2025-54458MEDIUMUnauthorized Subscription Creation to Confluence Space in Mattermost Confluence PluginEPSS 0.2%