CVE-2025-13352: Mattermost Server: güvenlik açığı

Açıklama (NVD)

Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.

Özet bilgiler

Ürün

Mattermost Mattermost Server

CVSS v3.1

3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

EPSS

%0,18 (yüzdelik 7)

CWE

CWE-1287

Yama

Yok / bilinmiyor

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• mattermost.com
• CWE-1287