What is the CVSS score of CVE-2025-4573?

CVE-2025-4573 has a CVSS 3.1 base score of 4.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of LDAP are affected by CVE-2025-4573?

CVE-2025-4573 presents moderate security risk rated CVSS 4.1. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-4573?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

LDAP CVE-2025-4573

EUVD-2025-18095 MEDIUM

LDAP Injection (CWE-90)

2025-06-11 responsibledisclosure@mattermost.com

GHSA-4r67-4x4p-fprg

LDAP Code Injection Debian Mattermost Server Suse

4.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.1 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 21:09 euvd

EUVD-2025-18095

Analysis Generated

Mar 14, 2026 - 21:09 vuln.today

CVE Published

Jun 11, 2025 - 11:15 nvd

MEDIUM 4.1

DescriptionCVE.org

Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remote_id}/link API when objectGUID is configured as the Group ID Attribute.

Analysis

Technical ContextAI

This vulnerability is classified as LDAP Injection (CWE-90).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

More in LDAP

View all

CVE-2016-9299 CRITICAL Act Now POC

9.8 Jan 12

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a

CVE-2017-14596 CRITICAL Act Now POC

9.8 Sep 20

In Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required,

CVE-2017-8790 CRITICAL Act Now POC

9.8 May 05

An issue was discovered on Accellion FTA devices before FTA_9_12_180. Rated critical severity (CVSS 9.8), this vulnerabi

CVE-2023-28853 MEDIUM This Month POC

6.5 Apr 04

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for aut

CVE-2020-36966 MEDIUM This Month POC

6.4 Jan 30

Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows at

CVE-2025-36556 MEDIUM This Month POC

6.1 Jan 20

A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6

CVE-2026-23906 CRITICAL Act Now

9.8 Feb 10

Authentication bypass in Apache Druid versions 0.17.0 through 35.x. Affects all versions prior to 36.0.0 when specific p

CVE-2026-44930 CRITICAL Act Now

9.8 May 22

Arbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)

CVE-2024-33868 CRITICAL Act Now

9.8 May 14

An issue was discovered in linqi before 1.4.0.1 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is re

CVE-2023-6905 CRITICAL Act Now

9.8 Dec 18

A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5.jsp?actionFlag=test&i

CVE-2021-43350 CRITICAL Act Now

9.8 Nov 11

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the P

CVE-2026-21880 MEDIUM This Month POC

5.3 Jan 08

Kanboard versions 1.2.48 and earlier contain an LDAP injection vulnerability where unsanitized user input in the LDAP au

Same weakness CWE-90 – LDAP Injection

View all

CVE-2016-9299 CRITICAL POC

9.8

CVE-2017-14596 CRITICAL POC

9.8

CVE-2017-8790 CRITICAL POC

9.8

CVE-2023-28853 MEDIUM POC

6.5

CVE-2026-44930 CRITICAL

9.8

CVE-2024-33868 CRITICAL

9.8

CVE-2023-6905 CRITICAL

9.8

CVE-2021-43350 CRITICAL

9.8

Same technique Code Injection

View all

CVE-2012-0158 HIGH POC

8.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2025-24893 CRITICAL POC

9.8

CVE-2025-47812 CRITICAL POC

10.0

CVE-2013-3906 HIGH POC

7.8

CVE-2017-9822 HIGH POC

8.8

CVE-2018-1273 CRITICAL POC

9.8

Vendor StatusVendor

Debian

Bug #823556

mattermost-server

Release	Status	Fixed Version	Urgency
	open	-	-

SUSE

Severity: Medium

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:latest	Affected
SUSE Linux Enterprise Server 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed

CVE-2025-4573 vulnerability details – vuln.today

Back

LDAP CVE-2025-4573

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in LDAP

Same weakness CWE-90 – LDAP Injection

Same technique Code Injection

Vendor StatusVendor

Debian

SUSE

Share

External POC / Exploit Code