← Back

CVE-2025-31947

nvd nist
Published: May 15, 2025Modified: Jun 17, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.

Affected (4)

Mattermost
1 product
Mattermost Server
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Mattermost
Mattermost Server
From 10.4.0 to 10.4.5
Mattermost Server
From 10.5.0 to 10.5.3
Mattermost Server
From 10.6.0 to 10.6.2
Mattermost Server
From 9.11.0 to 9.11.12

Related CWEs

CWE-645
Overly Restrictive Account Lockout Mechanism
The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.

References (1)

Source: responsibledisclosure@mattermost.com
Vendor Advisory

Timeline

No history available yet.