Mattermost Jira Plugin Authentication Bypass Vulnerability Allowing Unauthenticated Issue Key Injection

A vulnerability exists in Mattermost versions 11.1.0, 11.0.5, 10.12.3, and 10.11.7 with the Jira plugin enabled. The issue arises in Jira plugin versions through 4.4.0, where authentication and issue-key path restrictions are not properly enforced. This flaw allows an unauthenticated attacker who knows a valid user ID to send authenticated GET and POST requests to the Jira server. Exploitation involves crafting plugin payloads that spoof the user ID and inject arbitrary issue key paths.

Impact

Successful exploitation allows for unauthorized injection of issue key paths, potentially leading to manipulation of Jira issues on behalf of the spoofed user.

Remediation

Users can upgrade to Mattermost versions 11.2.0, 11.1.8, 11.0.6, or 10.12.4, where this vulnerability has been addressed.