GHSA-6ff3-jgxh-vffj
Mattermost Confluence Plugin is Missing Authentication for Critical Function
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-plugin-confluence | < 1.5.0 | 1.5.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Mattermost Confluence Plugin version <1.5.0 fails to check the authorization of the user to the Mattermost instance which allows attackers to create a channel subscription without proper authorization via API call to the create channel subscription endpoint.
References
External links from the advisory. They lead to third-party sites.