CVE-2025-9072
BaseFortify
Publication date: 2025-09-15
Last updated on: 2025-09-16
Assigner: Mattermost, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | mattermost_server | From 10.5.0 (inc) to 10.5.10 (exc) |
| mattermost | mattermost_server | From 10.9.0 (inc) to 10.9.5 (exc) |
| mattermost | mattermost_server | From 10.10.0 (inc) to 10.10.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-601 | The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in certain versions of Mattermost where the application fails to properly validate the 'redirect_to' parameter. An attacker can craft a malicious link that, after a user authenticates via their SAML provider, causes the user's cookies to be sent to a URL controlled by the attacker.
How can this vulnerability impact me? :
The vulnerability can lead to the theft of user cookies, which may allow an attacker to hijack user sessions or gain unauthorized access to user accounts, potentially compromising confidentiality and integrity of user data.