Low WID-SEC-2025-1006 2 CVEs

Mattermost: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Published May 12, 2025 · Updated Jun 11, 2025 · Revision 2 · de-DE

Vendor: Mattermost Product: Mattermost Platform: Linux Platform: Windows

Summary

Ein authentisierter Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um Informationen offenzulegen.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 2

Medium 4.1

CVE-2025-4573

LDAP Injection in Mattermost Enterprise Edition When Using Active Directory

Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LD…

Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go

Jun 11, 2025
Low 3.1

CVE-2025-4128

Mattermost Guest User Information Disclosure Vulnerability

Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams…

Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go

Jun 11, 2025

Revision history

2025-06-11 #2
Beschreibungen und CVE Nummern ergänzt
2025-05-12 #1
Initiale Fassung

References

Mattermost Security Updates vom 2025-05-12
https://mattermost.com/security-updates/#server