CVE-2025-55073
MS Teams plugin OAuth allows editing arbitrary posts
Résumé
MS Teams plugin OAuth allows editing arbitrary posts
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com