Mattermost Server 10.11.x < 10.11.8 / 10.12.x < 10.12.4 / 11.0.x <= 11.0.6 / 11.1.x <= 11.1.1 Improper Authentication (MMSA-2025-00555)

#%NASL_MIN_LEVEL 80900

##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(280123);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/24");

  script_cve_id("CVE-2025-14273");
  script_xref(name:"IAVA", value:"2025-A-0893-S");

  script_name(english:"Mattermost Server 10.11.x < 10.11.8 / 10.12.x < 10.12.4 / 11.0.x <= 11.0.6 / 11.1.x <= 11.1.1 Improper Authentication (MMSA-2025-00555)");

  script_set_attribute(attribute:"synopsis", value:
"The Mattermost Server installed on the remote host is affected by an improper authentication vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Mattermost Server installed on the remote host is 10.11.x prior to 10.11.8, 10.12.x prior to 10.12.4,
11.0.x prior to 11.0.6, or 11.1.x prior to 11.1.1, and is, therefore, affected by an improper authentication
vulnerability:

  - Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin
    enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions
    in the Jira plugin, which allows an unauthenticated attacker who knows a valid user ID to issue authenticated GET
    and POST requests to the Jira server via crafted plugin payloads that spoof the user ID and inject arbitrary issue
    key paths. Mattermost Advisory ID: MMSA-2025-00555. (CVE-2025-14273)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mattermost.com/security-updates/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Mattermost Server version 10.11.8, 10.12.4, 11.0.6, or 11.1.1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-14273");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:mattermost:mattermost_server");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("mattermost_server_detect.nbin");
  script_require_keys("installed_sw/Mattermost Server");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Mattermost Server', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version':'10.11.0','fixed_version':'10.11.8'},
        {'min_version':'10.12.0','fixed_version':'10.12.4'},
        {'min_version':'11.0.0','fixed_version':'11.0.6'},
        {'min_version':'11.1.0','fixed_version':'11.1.1'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);