4.1
CVE-2025-4573
- EPSS 0.21%
- Veröffentlicht 11.06.2025 10:22:24
- Zuletzt bearbeitet 08.07.2025 17:59:16
- Quelle responsibledisclosure@mattermo
- CVE-Watchlists
- Unerledigt
LDAP Injection in Mattermost Enterprise Edition When Using Active Directory
Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remote_id}/link API when objectGUID is configured as the Group ID Attribute.Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mattermost ≫ Mattermost Server Version >= 9.11.0 < 9.11.14
Mattermost ≫ Mattermost Server Version >= 10.5.0 < 10.5.5
Mattermost ≫ Mattermost Server Version >= 10.6.0 < 10.6.4
Mattermost ≫ Mattermost Server Version >= 10.7.0 < 10.7.2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.21% | 0.431 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| responsibledisclosure@mattermost.com | 4.1 | 2.3 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
|
CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.