← CVE Intelligence

CVE-2025-64641

Mattermost Jira plugin crafted action leaks Jira issue details PUBLISHED

Description (CNA)

Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfiltrate Jira tickets when victim users interacted with affected posts

Affected (CNA)

Vendor / productVersions
Mattermost / Mattermostaffected 11.1.0 through 11.1.0; affected 11.0.0 through 11.0.5; affected 10.12.0 through 10.12.3; affected 10.11.0 through 10.11.7; unaffected 11.2.0; unaffected 11.1.1; unaffected 11.0.6; unaffected 10.12.4; unaffected 10.11.8

CWE

CWE-863

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.