{"id":"EUVD-2025-29172","enisaUuid":"28ede293-9183-347a-a0c6-d588b0a74d88","description":"Mattermost versions 10.5.x \u003c\u003d 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs","datePublished":"Sep 15, 2025, 10:22:30 AM","dateUpdated":"Sep 15, 2025, 12:24:41 PM","baseScore":3.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2025-9084\nGHSA-hm95-jx66-g2gh\n","assigner":"Mattermost","epss":0.17,"enisaIdProduct":[{"id":"1e2dff74-2b4c-3bbb-9683-d2ff5bd5b1c1","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.9"},{"id":"587478cb-8621-3a3b-88bb-40e3685f8dfc","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":""}],"enisaIdVendor":[{"id":"587478cb-8621-3a3b-88bb-40e3685f8dfc","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"d59cd762-a0fe-3b24-ad77-687be995e534","vulnerability":{"id":"CVE-2025-9084","description":"Mattermost versions 10.5.x \u003c\u003d 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs","datePublished":"Sep 15, 2025, 10:22:30 AM","dateUpdated":"Sep 15, 2025, 12:24:41 PM","status":"PUBLISHED","baseScore":3.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-29172\n","assigner":"Mattermost","epss":0.17,"dataProcessed":"Oct 29, 2026, 7:15:26 AM","vulnerabilityProduct":[{"id":"427484a4-e519-3af3-8b5e-108822052e25","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":""},{"id":"95944b66-f1f9-3e82-9688-afb93d2d1568","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.9"},{"id":"de7d0904-f21f-42c5-ac98-afb4cba45701","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.9"}],"vulnerabilityVendor":[{"id":"427484a4-e519-3af3-8b5e-108822052e25","vendor":{"name":"Mattermost"}}]}},{"id":"e96c546d-c567-307a-a953-d881001f92ac","vulnerability":{"id":"GHSA-hm95-jx66-g2gh","description":"Mattermost Open Redirect vulnerability","datePublished":"Sep 15, 2025, 12:31:25 PM","dateUpdated":"Sep 16, 2025, 8:00:25 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-9084\nhttps://github.com/mattermost/mattermost/commit/39bd251fe4f66b7e847fc6d653221886347ff160\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-29172\n","aliases":"GHSA-hm95-jx66-g2gh\nCVE-2025-9084\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:12:52 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"76a970cb-f238-39aa-9f0e-73b9b9fd7cc6","advisory":{"id":"openSUSE-SU-2025:15564-1","description":"govulncheck-vulndb-0.0.20250917T170349-1.1 on GA media","summary":"govulncheck-vulndb-0.0.20250917T170349-1.1 on GA media","datePublished":"Sep 18, 2025, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 9:42:03 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15564-1.json\nhttps://www.suse.com/security/cve/CVE-2025-4953/\nhttps://www.suse.com/security/cve/CVE-2025-54123/\nhttps://www.suse.com/security/cve/CVE-2025-54376/\nhttps://www.suse.com/security/cve/CVE-2025-58058/\nhttps://www.suse.com/security/cve/CVE-2025-58063/\nhttps://www.suse.com/security/cve/CVE-2025-58157/\nhttps://www.suse.com/security/cve/CVE-2025-58158/\nhttps://www.suse.com/security/cve/CVE-2025-58430/\nhttps://www.suse.com/security/cve/CVE-2025-58437/\nhttps://www.suse.com/security/cve/CVE-2025-58445/\nhttps://www.suse.com/security/cve/CVE-2025-58450/\nhttps://www.suse.com/security/cve/CVE-2025-59358/\nhttps://www.suse.com/security/cve/CVE-2025-59359/\nhttps://www.suse.com/security/cve/CVE-2025-59360/\nhttps://www.suse.com/security/cve/CVE-2025-59361/\nhttps://www.suse.com/security/cve/CVE-2025-7445/\nhttps://www.suse.com/security/cve/CVE-2025-8396/\nhttps://www.suse.com/security/cve/CVE-2025-9072/\nhttps://www.suse.com/security/cve/CVE-2025-9076/\nhttps://www.suse.com/security/cve/CVE-2025-9078/\nhttps://www.suse.com/security/cve/CVE-2025-9084/\n","aliases":"CVE-2025-4953\nCVE-2025-54123\nCVE-2025-54376\nCVE-2025-58058\nCVE-2025-58063\nCVE-2025-58157\nCVE-2025-58158\nCVE-2025-58430\nCVE-2025-58437\nCVE-2025-58445\nCVE-2025-58450\nCVE-2025-59358\nCVE-2025-59359\nCVE-2025-59360\nCVE-2025-59361\nCVE-2025-7445\nCVE-2025-8396\nCVE-2025-9072\nCVE-2025-9076\nCVE-2025-9078\nCVE-2025-9084\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"1cc76f98-371a-3fc6-aee6-5eadf51878a2","product":{"name":"govulncheck-vulndb-0.0.20250917T170349-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"29107cb4-f129-3481-ac9b-db60712e7317","product":{"name":"govulncheck-vulndb-0:0.0.20250917T170349-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"29cdf64b-9d51-3131-8329-d2fe15008bbb","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"2e830e5b-5857-3f97-a80c-b3a30b97b6c2","product":{"name":"govulncheck-vulndb-0:0.0.20250917T170349-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"610e85a2-a76d-3b52-ae27-3bf4aba41ec0","product":{"name":"govulncheck-vulndb-0.0.20250917T170349-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"736c93eb-17d0-3c0d-9744-877b4b8ffc8d","product":{"name":"govulncheck-vulndb-0:0.0.20250917T170349-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"ea17cf9d-e8f0-3a74-b23c-845080a781c5","product":{"name":"govulncheck-vulndb-0:0.0.20250917T170349-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"fb90779c-62f0-353d-b846-d907b8a69a19","product":{"name":"govulncheck-vulndb-0.0.20250917T170349-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"ff6a651c-8c7a-3ba4-be7f-c1564c968489","product":{"name":"govulncheck-vulndb-0.0.20250917T170349-1.1.s390x","vendor":{"name":"SUSE"}}}]}}]}