3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-47700

CVE-2025-47700: Mattermost Server SSRF Vulnerability via the Agents Plugin

Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post actions

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-47700

CVE-2025-47700:

3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	>= 10.5.0, <= 10.5.9	10.5.10
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250814075248-83a37a861d3c	8.0.0-20250814075248-83a37a861d3c

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a Server-Side Request Forgery (SSRF) in the Mattermost Server. The investigation began by identifying the patched version (10.5.10) and the last vulnerable version (10.5.9). A comparison of the commits between these two versions revealed a security-related commit with the message [MM-64911] Ensure redirect URL is validated before redirecting. This commit modified the fullyQualifiedRedirectURL function in server/channels/web/oauth.go. The code changes clearly show the addition of robust validation for the targetURL parameter, which was previously handled insecurely. The original implementation was susceptible to SSRF because it would concatenate a user-provided targetURL with the siteURLPrefix without proper validation, allowing an attacker to control the final URL and direct the server to make requests to arbitrary locations. The patch mitigates this by ensuring the scheme, host, and path of the targetURL are safe before constructing the final redirect URL. Although the vulnerability description mentions the 'Agents Plugin', the vulnerable function is in the core server's OAuth flow, which is likely leveraged by the plugin, making this the root cause of the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.