PT-2025-46948 · Mattermost · Teams (Msteams) Plugin+1

Juho Forsén · Publicado 2025-10-15 · Atualizado 2025-11-20 · CVE-2025-55073

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.x through 10.5.11 Mattermost versions 10.11.x through 10.11.3 Mattermost versions 10.12.x through 10.12.0

Description The Mattermost application does not properly validate the relationship between a post being updated and the Microsoft Teams (MSTeams) plugin OAuth flow. This allows an attacker to modify any post by using a specially crafted MSTeams plugin OAuth redirect URL. The issue involves a failure to validate the connection between the post update and the OAuth process.

Recommendations Update Mattermost to a version later than 10.5.11. Update Mattermost to a version later than 10.11.3. Update Mattermost to a version later than 10.12.0.

Correção

Improper Access Control

Missing Authentication

Enumeração de Fraquezas

CWE-284

CWE-306

Identificadores relacionados

BDU:2025-16014

CVE-2025-55073

GHSA-FF85-QW3H-G9VP

GO-2025-4129

Produtos afetados

Mattermost

Teams (Msteams) Plugin

Referências · 18

• https://github.com/mattermost/mattermost · Nota
• https://github.com/mattermost/mattermost/commit/a41db04d2746ab549d056db4ede4cd803f64989c · Nota
• https://github.com/mattermost/mattermost/commit/375ce229f4923205394d8f27925372b2cbf28130 · Nota
• https://github.com/mattermost/mattermost/commit/e47349ea0fc072ee1dfb196d9bb1c8fd1a589224 · Nota
• https://github.com/mattermost/mattermost/commit/b822cea06bf5683a176e2c92711241bd29cd9389 · Nota
• https://github.com/mattermost/mattermost/commit/6c288aa62bb3343183ec1d0a06360d14aa0193e9 · Nota
• https://osv.dev/vulnerability/GHSA-ff85-qw3h-g9vp · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-55073 · Nota de Segurança
• https://twitter.com/dailycve/status/1991338731987456300 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1989261172810391886 · Publicação no Twitter
• https://mattermost.com/security-updates · Aviso do Fabricante
• https://t.me/CVEtracker/37323 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2025-16014 · Nota de Segurança
• https://github.com/advisories/GHSA-ff85-qw3h-g9vp · Nota
• https://twitter.com/CVEnew/status/1989261506584908038 · Publicação no Twitter