7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-14273

CVE-2025-14273: Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm

Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which allows an unauthenticated attacker who knows a valid user ID to issue authenticated GET and POST requests to the Jira server via crafted plugin payloads that spoof the user ID and inject arbitrary issue key paths. Mattermost Advisory ID: MMSA-2025-00555

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-14273

CVE-2025-14273:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20251121122154-b57c297c6d7a	8.0.0-20251121122154-b57c297c6d7a
github.com/mattermost/mattermost-plugin-jira	go	< 4.4.1	4.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the mattermost-plugin-jira Go package, specifically in how it handled authentication for post actions. The analysis of the security patch bf9a1b7e81eb83304056b397c6abab3b062e14a2 reveals the root cause.

Two functions, httpShareIssuePublicly and httpTransitionIssuePostAction in server/issue.go, were identified as vulnerable. Before the patch, both functions extracted the user's identity from the UserId field within the JSON payload of the incoming HTTP request (mattermostUserID := requestData.UserId). This is insecure because an unauthenticated attacker can freely control the content of the request body and thus spoof any user's ID.

The patch rectifies this by instead reading the user's ID from the Mattermost-User-ID HTTP header (authenticatedUserID := strings.TrimSpace(r.Header.Get(headerMattermostUserID))). This header is added by the Mattermost server itself during request proxying to the plugin, and is a trusted source of the authenticated user's identity.

Additionally, the patch introduces further security checks:

It validates that the Mattermost-User-ID header is present.
It validates the post associated with the action, ensuring it exists and was created by the Jira bot.
It validates the issueKey format to prevent path injection style attacks.

Therefore, during exploitation, a profiler would show calls to Plugin.httpShareIssuePublicly or Plugin.httpTransitionIssuePostAction as these are the entry points that process the malicious, unauthenticated requests. The other commits listed are merely updates to the Mattermost server to include the patched version of the Jira plugin.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.