CVE-2025-2424

{"id": "CVE-2025-2424", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}]}, "published": "2025-04-14T15:15:24.630", "references": [{"url": "https://mattermost.com/security-updates", "source": "responsibledisclosure@mattermost.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to check if a file has been deleted when creating a bookmark which allows an attacker who knows the IDs of deleted files to obtain metadata of the files via bookmark creation."}, {"lang": "es", "value": "Las versiones 10.5.x &lt;= 10.5.1, 9.11.x &lt;= 9.11.9 de Mattermost no verifican si se ha eliminado un archivo al crear un marcador, lo que permite que un atacante que conoce los identificadores de los archivos eliminados obtenga metadatos de los archivos a trav\u00e9s de la creaci\u00f3n de un marcador."}], "lastModified": "2025-04-15T18:39:27.967", "sourceIdentifier": "responsibledisclosure@mattermost.com"}