CVE-2025-31947

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-645

Affected software

No affected versions have been published.

Timeline

Published: May 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-319483.3Improper input validation for some Intel(R) oneAPI Math Kernel Library before version 2025.2 within Ring 3: User Applications may allow a de CVE-2025-319495.3An authenticated attacker can obtain any plant name by knowing the plant ID.CVE-2025-31959.8A vulnerability, which was classified as critical, has been found in itsourcecode Online Blood Bank Management System 1.0. This issue affect CVE-2025-319505.3An unauthenticated attacker can obtain EV charger energy consumption information of other users.CVE-2025-319518.8HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a component's input h CVE-2025-319527.1HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, i CVE-2025-319536.5HCL iAutomate includes hardcoded credentials which may result in potential exposure of confidential data if intercepted or accessed by unaut CVE-2025-319544.3HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. An HTTP GET method is used to process a request and i CVE-2025-319556.5HCL iAutomate is affected by a sensitive data exposure vulnerability. This issue may allow unauthorized access to sensitive information wit CVE-2025-319575.7HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized chang CVE-2025-319588.2HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HT CVE-2025-319593.5HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and pr