CVE-2025-20072
Mattermost Mobile ≤ 2.23.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2025-20072 is a medium-severity Incorrect Type Conversion or Cast (CWE-704) vulnerability in Mattermost Mattermost Mobile. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-20072 affects Mattermost Mobile versions up to and including 2.22.0. The vulnerability stems from a failure to properly validate the style property of proto supplied to an action's style in post.props.attachments. This issue, published on 2025-01-16 and associated with CWE-704 (Incorrect Type Conversion or Cast), carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating medium severity primarily due to high availability impact.
An attacker requires low privileges, such as those of an authenticated user on a Mattermost server, to exploit the vulnerability over the network. Exploitation involves low complexity and no user interaction, allowing the attacker to deliver crafted malicious input that crashes the victim's Mattermost Mobile application, resulting in a denial-of-service condition without affecting confidentiality or integrity.
Mattermost has published security updates addressing this issue at https://mattermost.com/security-updates, where practitioners can find details on patches and mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2148
Vulnerability Data
Mattermost Mobile versions <= 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the mobile via crafted malicious input.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (static analysis, fuzzing, unit tests) directly finds incorrect type conversions or casts.
Requiring documented development standards and tools can mandate safe typing, casting rules, and compiler checks that stop the weakness from being introduced.
Security engineering principles can require type-safe design and casting practices that structurally avoid incorrect conversions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent type-conversion flaws via coding standards, reviews, and testing.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can uncover type-conversion defects before release.
Secure development lifecycle includes type-safety reviews that reduce incorrect casts.
Application security requirements can mandate strong typing and safe casting rules.
Secure architecture principles discourage unsafe type conversions in design.
Secure coding standards directly forbid or detect incorrect type casts.