CVE-2025-14273: Mattermost Jira plugin user spoofing enables Jira request forgery.
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which allows an unauthenticated attacker who knows a valid user ID to issue authenticated GET and POST requests to the Jira server via crafted plugin payloads that spoof the user ID and inject arbitrary issue key paths. Mattermost Advisory ID: MMSA-2025-00555
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14273?
CVE-2025-14273 has a critical severity rating due to its potential to allow unauthorized access to sensitive data.
How do I fix CVE-2025-14273?
To remediate CVE-2025-14273, upgrade to Mattermost versions above 11.1.0, 11.0.5, 10.12.3, 10.11.7, and ensure the Jira plugin is updated beyond version 4.4.0.
What types of systems are affected by CVE-2025-14273?
CVE-2025-14273 affects Mattermost versions 11.1.x, 11.0.x, 10.12.x, 10.11.x, and the Jira plugin versions up to and including 4.4.0.
What can an attacker do with CVE-2025-14273?
An attacker exploiting CVE-2025-14273 can bypass authentication and gain unauthorized access to Jira issues.
Is the fixing of CVE-2025-14273 urgent?
Yes, patching CVE-2025-14273 is urgent due to its ability to compromise security and access management.