CVE-2025-24490

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statements in the SQL query of boards reordering which allows an attacker to retrieve data from the database, via a SQL injection when reordering specially crafted boards categories.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	>= 10.4.0, <= 10.4.1; >= 9.11.0, <= 9.11.7; >= 10.3.0, <= 10.3.2; >= 10.2.0, <= 10.2.2

References

https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Feb 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-244916.7Uncontrolled search path for some Intel(R) Killer(TM) Performance Suite software before version killer 4.0 40.25.509.1465 within Ring 3: Use CVE-2025-244934.7in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through race condition.CVE-2025-244947.2Path traversal may allow remote code execution using privileged account (requires device admin account, cannot be performed by a regular us CVE-2025-244955.6Incorrect initialization of resource in the branch prediction unit for some Intel(R) Core™ Ultra Processors may allow an authenticated user CVE-2025-244967.5An information disclosure vulnerability exists in the /goform/getproductInfo functionality of Tenda AC6 V5.0 V02.03.01.110. Specially crafte CVE-2025-244977.5When URL categorization is configured on a virtual server, undisclosed requests can cause TMM to terminate. Note: Software versions which h CVE-2025-244997.2A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0 CVE-2025-24508.8NI Vision Builder AI VBAI File Processing Missing Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to CVE-2025-245008.7The vulnerability allows an unauthenticated attacker to access information in PAM database.CVE-2025-245015.3An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request.CVE-2025-245025.3An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an CVE-2025-245039.3A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server.