3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-13321

CVE-2025-13321: Mattermost Desktop App exposes sensitive information in its application logs

Mattermost Desktop App versions < 6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker with access to the users system to gain access to potentially sensitive information via reading the application logs.

A fix is available for direct download via the Mattermost Desktop repository, but it has not been uploaded to the npm registry at time of publication.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-13321

CVE-2025-13321:

3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mattermost-desktop	npm	<= 3.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in two main areas: logging of sensitive information and incomplete data cleanup. The analysis of the patch 722938bb6a97e8b8a5678e6858e44c4d505c08ee confirms this.

First, multiple functions across the application were logging potentially sensitive data, such as server URLs, deep-linking URLs, certificate details, and server configuration objects. An attacker with local file system access could read these logs to gather information about the servers the user is connected to. The patch addresses this by systematically removing this data from log calls in functions like handleAppCertificateError, handleServerURLValidation, and generateHandleConsoleMessage. The generateHandleConsoleMessage function is particularly notable as it now sanitizes renderer process logs to strip out hostnames.

Second, the application failed to clear session data when a server was removed. The ServerManager.removeServer function would delete the server from the configuration but left the corresponding cookies, local storage, and other session data on disk. The patch introduces a new function, ServerHub.handleServerCleanup, which explicitly calls session.defaultSession.clearData for the removed server's origin. This cleanup is triggered by an event now emitted from the removeServer function, closing the data leakage gap.

Vulnerable functions

ServerManager.removeServer

src/common/servers/serverManager.ts

This function is responsible for removing a server configuration. Prior to the patch, it did not trigger any cleanup of the session data (like cookies or local storage) associated with that server's origin. An attacker with local access could potentially recover this data from the application's cache. The fix was to emit a `SERVER_REMOVED` event, which is now handled by `ServerHub.handleServerCleanup` to clear the corresponding session data.

generateHandleConsoleMessage

src/app/views/webContentEventsCommon.ts

This function logs console messages originating from the web-based content of the application. Before the patch, it would log the raw message content, which could include sensitive information like server hostnames if they were part of the console output. The patch introduces a `sanitizeMessage` function to redact hostnames, preventing them from being written to the log files.

handleAppCertificateError

src/main/app/app.ts

This function handles certificate errors. The vulnerable version logged the full URL and certificate details associated with the error. This could expose sensitive server URLs and certificate information in the application logs. The patch removes the `url` and `certificate` objects from the log entry.

handleAppWillFinishLaunching

src/main/app/app.ts

This function is triggered when the application is launched via a deep link. The vulnerable version logged the full deep-linking URL, which could contain sensitive information such as session tokens or specific paths. The patch removes the URL from the log message to avoid exposing this data.

ServerHub.handleServerURLValidation

src/app/serverHub.ts

This function was used to validate a server URL. The vulnerable version logged the full URL being validated, which could expose server addresses in the logs. The patch removes the URL from the log call, redacting potentially sensitive information.

ServerManager.addServer

src/common/servers/serverManager.ts

This function logged the entire server object and initial URL when a new server was added. This server object could contain sensitive configuration details. The patch removes the server object and URL from the log call to prevent this information from being stored in the logs.

MattermostWebContentsView.load

src/app/views/MattermostWebContentsView.ts

This function logged the full URL that was being loaded into a web view. This could expose server addresses or other internal URLs in the application logs. The patch removes the dynamic URL from the log message.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.