Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/mattermost/mattermost-plugin-jira < 4.4.1
Fixed in
4.4.1· Vendor fix available
Issue
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which allows an unauthenticated attacker who knows a valid user ID to issue authenticated GET and POST requests to the Jira server via crafted plugin payloads that spoof the user ID and inject arbitrary issue key paths. Mattermost Advisory ID: MMSA-2025-00555
Recommended action: Upgrade to 4.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-plugin-jira < 4.0.0-rc1
Fixed in
4.0.0-rc1· Vendor fix available
Issue
Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues.
Recommended action: Upgrade to 4.0.0-rc1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-plugin-jira < 1.1.2-0.20230830170046-f4cf4c6de017
Fixed in
1.1.2-0.20230830170046-f4cf4c6de017· Vendor fix available
Issue
Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.
Recommended action: Upgrade to 1.1.2-0.20230830170046-f4cf4c6de017 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.