Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mattermost Jira plugin user spoofing enables Jira request forgery.
Vulnerability Description
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which allows an unauthenticated attacker who knows a valid user ID to issue authenticated GET and POST requests to the Jira server via crafted plugin payloads that spoof the user ID and inject arbitrary issue key paths. Mattermost Advisory ID: MMSA-2025-00555
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
Vulnerability Type
认证算法的不正确实现
Vulnerability Title
Mattermost 安全漏洞
Vulnerability Description
Mattermost是美国Mattermost公司的一个开源协作平台。 Mattermost 11.1.0及之前的11.1.x版本、11.0.5及之前的11.0.x版本、10.12.3及之前的10.12.x版本和10.11.7及之前的10.11.x版本存在安全漏洞，该漏洞源于Jira插件未强制执行身份验证和问题键路径限制，可能导致未经身份验证的攻击者通过特制插件有效载荷向Jira服务器发出经过身份验证的GET和POST请求。
CVSS Information
N/A
Vulnerability Type
N/A