CVE-2025-24490
SQL Injection in Mattermost Boards via board category ID reordering
Résumé
SQL Injection in Mattermost Boards via board category ID reordering
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statements in the SQL query of boards reordering which allows an attacker to retrieve data from the database, via a SQL injection when reordering specially crafted boards categories.
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com