CVE-2025-9072 - Vulnerability Details - OpenCVE

Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user’s cookies to an attacker-controlled URL.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00038.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

No data.

Fixes

Solution

Update Mattermost to versions 10.11.0, 10.10.2, 10.5.10, 10.9.5 or higher.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://mattermost.com/security-updates

History

Mon, 15 Sep 2025 12:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 15 Sep 2025 10:45:00 +0000

Type	Values Removed	Values Added
Description		Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user’s cookies to an attacker-controlled URL.
Title		One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter
Weaknesses		CWE-601
References		https://mattermost.com/security-updates
Metrics		cvssV3_1 `{'score': 7.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: Mattermost

Published: 2025-09-15T10:28:17.356Z

Updated: 2025-09-15T12:06:57.518Z

Reserved: 2025-08-15T14:59:12.540Z

Link: CVE-2025-9072

Vulnrichment

Updated: 2025-09-15T12:04:08.711Z

NVD

Status : Received

Published: 2025-09-15T11:15:34.183

Modified: 2025-09-15T11:15:34.183

Link: CVE-2025-9072

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-9072", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2025-08-15T14:59:12.540Z", "datePublished": "2025-09-15T10:28:17.356Z", "dateUpdated": "2025-09-15T12:06:57.518Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "10.10.1", "status": "affected", "version": "10.10.0", "versionType": "semver"}, {"lessThanOrEqual": "10.5.9", "status": "affected", "version": "10.5.0", "versionType": "semver"}, {"lessThanOrEqual": "10.9.4", "status": "affected", "version": "10.9.0", "versionType": "semver"}, {"version": "10.11.0", "status": "unaffected"}, {"version": "10.10.2", "status": "unaffected"}, {"version": "10.5.10", "status": "unaffected"}, {"version": "10.9.5", "status": "unaffected"}]}], "credits": [{"lang": "en", "type": "finder", "value": "DoyenSec"}], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user\u2019s cookies to an attacker-controlled URL."}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "baseSeverity": "HIGH", "baseScore": 7.6}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE\u2011601: URL Redirection to Untrusted Site (\u201cOpen Redirect\u201d)", "cweId": "CWE-601"}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"value": "Update Mattermost to versions 10.11.0, 10.10.2, 10.5.10, 10.9.5 or higher.", "lang": "en"}], "source": {"advisory": "MMSA-2025-00509", "defect": ["https://mattermost.atlassian.net/browse/MM-64910"], "discovery": "EXTERNAL"}, "title": "One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter", "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-09-15T10:28:17.356Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-15T12:03:54.190037Z", "id": "CVE-2025-9072", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-15T12:06:57.518Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9072", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-15T12:03:54.190037Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-15T12:04:08.711Z"}}], "cna": {"title": "One-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-64910"], "advisory": "MMSA-2025-00509", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "DoyenSec"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "10.10.0", "versionType": "semver", "lessThanOrEqual": "10.10.1"}, {"status": "affected", "version": "10.5.0", "versionType": "semver", "lessThanOrEqual": "10.5.9"}, {"status": "affected", "version": "10.9.0", "versionType": "semver", "lessThanOrEqual": "10.9.4"}, {"status": "unaffected", "version": "10.11.0"}, {"status": "unaffected", "version": "10.10.2"}, {"status": "unaffected", "version": "10.5.10"}, {"status": "unaffected", "version": "10.9.5"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost to versions 10.11.0, 10.10.2, 10.5.10, 10.9.5 or higher."}], "references": [{"url": "https://mattermost.com/security-updates"}], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user\u2019s cookies to an attacker-controlled URL."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE\u2011601: URL Redirection to Untrusted Site (\u201cOpen Redirect\u201d)"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-09-15T10:28:17.356Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9072", "state": "PUBLISHED", "dateUpdated": "2025-09-15T12:06:57.518Z", "dateReserved": "2025-08-15T14:59:12.540Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2025-09-15T10:28:17.356Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.1"}