Vulnerability Details CVE-2025-64641
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfiltrate Jira tickets when victim users interacted with affected posts
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 6.5%
CVSS Severity
CVSS v3 Score 4.1
References
Products affected by CVE-2025-64641
-
cpe:2.3:a:mattermost:mattermost_server:10.11.0
-
cpe:2.3:a:mattermost:mattermost_server:10.11.1
-
cpe:2.3:a:mattermost:mattermost_server:10.11.2
-
cpe:2.3:a:mattermost:mattermost_server:10.11.3
-
cpe:2.3:a:mattermost:mattermost_server:10.11.4
-
cpe:2.3:a:mattermost:mattermost_server:10.11.5
-
cpe:2.3:a:mattermost:mattermost_server:10.11.6
-
cpe:2.3:a:mattermost:mattermost_server:10.11.7
-
cpe:2.3:a:mattermost:mattermost_server:10.12.0
-
cpe:2.3:a:mattermost:mattermost_server:10.12.1
-
cpe:2.3:a:mattermost:mattermost_server:10.12.2
-
cpe:2.3:a:mattermost:mattermost_server:10.12.3
-
cpe:2.3:a:mattermost:mattermost_server:11.0.0
-
cpe:2.3:a:mattermost:mattermost_server:11.0.1
-
cpe:2.3:a:mattermost:mattermost_server:11.0.2
-
cpe:2.3:a:mattermost:mattermost_server:11.0.3
-
cpe:2.3:a:mattermost:mattermost_server:11.0.4
-
cpe:2.3:a:mattermost:mattermost_server:11.0.5
-
cpe:2.3:a:mattermost:mattermost_server:11.1.0