Description
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfiltrate Jira tickets when victim users interacted with affected posts
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Mattermost Mattermost
Default version status: unaffected
11.1.0 to ≤ 11.1.0affected11.0.0 to ≤ 11.0.5affected10.12.0 to ≤ 10.12.3affected10.11.0 to ≤ 10.11.7affected11.2.0unaffected11.1.1unaffected11.0.6unaffected10.12.4unaffected10.11.8unaffected