CVE-2025-2424 in Mattermost

Riassunto

di MITRE • 14/04/2025

Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to check if a file has been deleted when creating a bookmark which allows an attacker who knows the IDs of deleted files to obtain metadata of the files via bookmark creation.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Responsabile: Mattermost
• Prenotare: 17/03/2025
• Divulgazione: 14/04/2025
• Moderazione: accettato
• Voce: VDB-304652
• CPE: pronto
• CWE: CWE-863 (confermato)
• CVSS: 3.1 (CNA)
• EPSS: 0.00225
• KEV: no
• Attività: molto basso
• Settore: Insurance, Homeoffice, ...

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-2424
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-2424
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-2424/