Skip to main content

Improper Validation of Specified Type of Input

CVE-2025-20033

Medium
6.5/10

Summary

Mattermost versions 9.11.0-rc1 through 9.11.5, 10.0.0-rc1 through 10.0.3, 10.1.0-rc1 through 10.1.3, 10.2.0-rc1 through 10.2.0, 10.3.0-rc1, and 10.3.0-rc2, fail to properly validate post types, which allows attackers to deny service to users with the "sysconsole_read_plugins" permission via creating a post with the "custom_pl_notification" type and specific props.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • NONE
  • HIGH

CWE-1287 - Improper Validation of Specified Type of Input

The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

References

Advisory Timeline

  • Published