What is the CVSS score of CVE-2025-4573?

CVE-2025-4573 has a CVSS 3.1 base score of 4.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of LDAP are affected by CVE-2025-4573?

CVE-2025-4573 presents moderate security risk rated CVSS 4.1. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-4573?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

LDAP CVE-2025-4573

EUVD-2025-18095 MEDIUM

LDAP Injection (CWE-90)

2025-06-11 responsibledisclosure@mattermost.com

GHSA-4r67-4x4p-fprg

LDAP Code Injection Debian Mattermost Server Suse

4.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.1 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 21:09 euvd

EUVD-2025-18095

Analysis Generated

Mar 14, 2026 - 21:09 vuln.today

CVE Published

Jun 11, 2025 - 11:15 nvd

MEDIUM 4.1

DescriptionCVE.org

Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remote_id}/link API when objectGUID is configured as the Group ID Attribute.

Analysis

Technical ContextAI

This vulnerability is classified as LDAP Injection (CWE-90).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

More in LDAP

View all

CVE-2016-9299 CRITICAL Act Now POC

9.8 Jan 12

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a

CVE-2017-14596 CRITICAL Act Now POC

9.8 Sep 20

In Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required,

CVE-2017-8790 CRITICAL Act Now POC

9.8 May 05

An issue was discovered on Accellion FTA devices before FTA_9_12_180. Rated critical severity (CVSS 9.8), this vulnerabi

CVE-2023-28853 MEDIUM This Month POC

6.5 Apr 04

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for aut

CVE-2020-36966 MEDIUM This Month POC

6.4 Jan 30

Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows at

CVE-2025-36556 MEDIUM This Month POC

6.1 Jan 20

A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6

CVE-2026-23906 CRITICAL Act Now

9.8 Feb 10

Authentication bypass in Apache Druid versions 0.17.0 through 35.x. Affects all versions prior to 36.0.0 when specific p

CVE-2026-44930 CRITICAL Act Now

9.8 May 22

Arbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)

CVE-2024-33868 CRITICAL Act Now

9.8 May 14

An issue was discovered in linqi before 1.4.0.1 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is re

CVE-2023-6905 CRITICAL Act Now

9.8 Dec 18

A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5.jsp?actionFlag=test&i

CVE-2021-43350 CRITICAL Act Now

9.8 Nov 11

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the P

CVE-2026-21880 MEDIUM This Month POC

5.3 Jan 08

Kanboard versions 1.2.48 and earlier contain an LDAP injection vulnerability where unsanitized user input in the LDAP au

Same weakness CWE-90 – LDAP Injection

View all

CVE-2016-9299 CRITICAL POC

9.8

CVE-2017-14596 CRITICAL POC

9.8

CVE-2017-8790 CRITICAL POC

9.8

CVE-2023-28853 MEDIUM POC

6.5

CVE-2026-44930 CRITICAL

9.8

CVE-2024-33868 CRITICAL

9.8

CVE-2023-6905 CRITICAL

9.8

CVE-2021-43350 CRITICAL

9.8

Same technique Code Injection

View all

CVE-2023-3519 CRITICAL POC

9.8

CVE-2021-22205 CRITICAL POC

10.0

CVE-2024-23692 CRITICAL POC

9.8

CVE-2012-0158 HIGH POC

8.8

CVE-2021-44529 CRITICAL POC

9.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2025-24893 CRITICAL POC

9.8

Vendor StatusVendor

Debian

Bug #823556

mattermost-server

Release	Status	Fixed Version	Urgency
	open	-	-

SUSE

Severity: Medium

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:latest	Affected
SUSE Linux Enterprise Server 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed

CVE-2025-4573 vulnerability details – vuln.today

Back

LDAP CVE-2025-4573

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in LDAP

Same weakness CWE-90 – LDAP Injection

Same technique Code Injection

Vendor StatusVendor

Debian

SUSE

Share

External POC / Exploit Code