CVE-2025-2424 in Mattermost

Resumen

por MITRE • 2025-04-14

Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to check if a file has been deleted when creating a bookmark which allows an attacker who knows the IDs of deleted files to obtain metadata of the files via bookmark creation.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Responsable: Mattermost
• Reservar: 2025-03-17
• Divulgación: 2025-04-14
• Moderación: aceptado
• Artículo: VDB-304652
• CPE: listo
• CWE: CWE-863 (confirmado)
• CVSS: 3.1 (CNA)
• EPSS: 0.00225
• KEV: no
• Actividades: muy bajo
• Sector: Telecommunication, Transportation, ...

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-2424
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-2424
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-2424/