CVE-2025-4573CWE-90

LDAP Injection in Mattermost Enterprise Edition When Using Active Directory

Medium · published June 11, 2025

CVSS v3.1
4.1
EPSS
0%
Percentile
19.0
In the wild
Unconfirmed
What it is

Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remote_id}/link API when objectGUID is configured as the Group ID Attribute.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00276 · 19.0th percentile
Weakness
CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Published
2025-06-11T10:22Z
EPSS history
Timeline
  • 11 JUN 10:22Z
    LDAP Injection in Mattermost Enterprise Edition When Using Active Directory
    cvelistv5