Description
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statements in the SQL query of boards reordering which allows an attacker to retrieve data from the database, via a SQL injection when reordering specially crafted boards categories.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | Mattermost | 10.4.0 – ≤ 10.4.1, 9.11.0 – ≤ 9.11.7, 10.3.0 – ≤ 10.3.2, 10.2.0 – ≤ 10.2.2 | 10.4.2 |
Advisories 2
- WID-SEC-2025-0187 Mattermost: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 24, 2025
- NCSC-2025-0068 Kwetsbaarheden verholpen in Mattermost NCSC-NL (Netherlands) · Feb 24, 2025