CVE-2025-24490
SQL Injection in Mattermost Boards via board category ID reordering
Summary
SQL Injection in Mattermost Boards via board category ID reordering
Original description
The description as published by the source.
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statements in the SQL query of boards reordering which allows an attacker to retrieve data from the database, via a SQL injection when reordering specially crafted boards categories.
References
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com