CVE-2025-27936
Webhook Secret Exposure via Timing attack in MSteams plugin
Résumé
Webhook Secret Exposure via Timing attack in MSteams plugin
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret comparison.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com