CVE-2025-20072
Published: 16 January 2025
Summary
CVE-2025-20072 is a medium-severity Incorrect Type Conversion or Cast (CWE-704) vulnerability in Mattermost Mattermost Mobile. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 46.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-20072 affects Mattermost Mobile versions up to and including 2.22.0. The vulnerability stems from a failure to properly validate the style property of proto supplied to an action's style in post.props.attachments. This issue, published on 2025-01-16 and associated with CWE-704 (Incorrect Type Conversion or Cast), carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating medium severity primarily due to high availability impact.
An attacker requires low privileges, such as those of an authenticated user on a Mattermost server, to exploit the vulnerability over the network. Exploitation involves low complexity and no user interaction, allowing the attacker to deliver crafted malicious input that crashes the victim's Mattermost Mobile application, resulting in a denial-of-service condition without affecting confidentiality or integrity.
Mattermost has published security updates addressing this issue at https://mattermost.com/security-updates, where practitioners can find details on patches and mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2148
Vulnerability details
Mattermost Mobile versions <= 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the mobile via crafted malicious input.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables crafted input to trigger client application crash (DoS) via type confusion in post attachment handling, directly matching application exploitation for endpoint denial of service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the failure to validate the style property in post.props.attachments, preventing crashes from crafted malicious input in the mobile app.
Requires timely remediation of the input validation flaw through patching Mattermost Mobile to versions beyond 2.22.0.
Mandates proper error handling for invalid proto styles to avoid application crashes and ensure graceful degradation.