CVE-2025-31947 - Vulnerability Details - OpenCVE

Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://mattermost.com/security-updates

History

Thu, 15 May 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 15 May 2025 10:45:00 +0000

Type	Values Removed	Values Added
Description		Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.
Title		Repeated LDAP login failures can lock an LDAP account
Weaknesses		CWE-645
References		https://mattermost.com/security-updates
Metrics		cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L'}`

MITRE

Status: PUBLISHED

Assigner: Mattermost

Published: 2025-05-15T10:41:42.104Z

Updated: 2025-05-15T13:46:27.427Z

Reserved: 2025-04-08T11:14:14.703Z

Link: CVE-2025-31947

Vulnrichment

Updated: 2025-05-15T13:44:49.181Z

NVD

Status : Awaiting Analysis

Published: 2025-05-15T11:15:48.270

Modified: 2025-05-16T14:43:26.160

Link: CVE-2025-31947

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-31947", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2025-04-08T11:14:14.703Z", "datePublished": "2025-05-15T10:41:42.104Z", "dateUpdated": "2025-05-15T13:46:27.427Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "10.6.1", "status": "affected", "version": "10.6.0", "versionType": "semver"}, {"lessThanOrEqual": "10.5.2", "status": "affected", "version": "10.5.0", "versionType": "semver"}, {"lessThanOrEqual": "10.4.4", "status": "affected", "version": "10.4.0", "versionType": "semver"}, {"lessThanOrEqual": "9.11.11", "status": "affected", "version": "9.11.0", "versionType": "semver"}, {"status": "unaffected", "version": "10.7.0"}, {"status": "unaffected", "version": "10.6.2"}, {"status": "unaffected", "version": "10.5.3"}, {"status": "unaffected", "version": "10.4.5"}, {"status": "unaffected", "version": "9.11.12"}]}], "credits": [{"lang": "en", "type": "finder", "value": "John Landells"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.</p>"}], "value": "Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-645", "description": "CWE-645: Overly Restrictive Account Lockout Mechanism", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-05-15T10:41:42.104Z"}, "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update Mattermost to versions 10.7.0, 10.6.2, 10.5.3, 10.4.5, 9.11.12 or higher.</p>"}], "value": "Update Mattermost to versions 10.7.0, 10.6.2, 10.5.3, 10.4.5, 9.11.12 or higher."}], "source": {"advisory": "MMSA-2024-00407", "defect": ["https://mattermost.atlassian.net/browse/MM-61707"], "discovery": "EXTERNAL"}, "title": "Repeated LDAP login failures can lock an LDAP account", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-15T13:43:06.790330Z", "id": "CVE-2025-31947", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-15T13:46:27.427Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-31947", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-15T13:43:06.790330Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-15T13:44:49.181Z"}}], "cna": {"title": "Repeated LDAP login failures can lock an LDAP account", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-61707"], "advisory": "MMSA-2024-00407", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "John Landells"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "10.6.0", "versionType": "semver", "lessThanOrEqual": "10.6.1"}, {"status": "affected", "version": "10.5.0", "versionType": "semver", "lessThanOrEqual": "10.5.2"}, {"status": "affected", "version": "10.4.0", "versionType": "semver", "lessThanOrEqual": "10.4.4"}, {"status": "affected", "version": "9.11.0", "versionType": "semver", "lessThanOrEqual": "9.11.11"}, {"status": "unaffected", "version": "10.7.0"}, {"status": "unaffected", "version": "10.6.2"}, {"status": "unaffected", "version": "10.5.3"}, {"status": "unaffected", "version": "10.4.5"}, {"status": "unaffected", "version": "9.11.12"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost to versions 10.7.0, 10.6.2, 10.5.3, 10.4.5, 9.11.12 or higher.", "supportingMedia": [{"type": "text/html", "value": "<p>Update Mattermost to versions 10.7.0, 10.6.2, 10.5.3, 10.4.5, 9.11.12 or higher.</p>", "base64": false}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.", "supportingMedia": [{"type": "text/html", "value": "<p>Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-645", "description": "CWE-645: Overly Restrictive Account Lockout Mechanism"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-05-15T10:41:42.104Z"}}}, "cveMetadata": {"cveId": "CVE-2025-31947", "state": "PUBLISHED", "dateUpdated": "2025-05-15T13:46:27.427Z", "dateReserved": "2025-04-08T11:14:14.703Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2025-05-15T10:41:42.104Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.1"}