CVE-2025-0503

Published Feb 14, 2025

Last updated 9 days ago

Overview

Description: Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from deleted DMs if someone had manually marked DMs as deleted in the database.
Source: responsibledisclosure@mattermost.com
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 3.1
Impact score: 1.4
Exploitability score: 1.6
Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity: LOW

Weaknesses

responsibledisclosure@mattermost.com: CWE-754

Hype score: Not currently trending

CVE-2025-0503 Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from delete… https://t.co/n7RtQsgyxx
@CVEnew
14 Feb 2025
375 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes

References