What is GHSA-2j87-p623-8cc2?

GHSA-2j87-p623-8cc2 is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost vulnerable to Observable Timing Discrepancy

Which CVE IDs does GHSA-2j87-p623-8cc2 cover?

GHSA-2j87-p623-8cc2 covers the following CVE IDs: CVE-2025-27936. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2j87-p623-8cc2?

GHSA-2j87-p623-8cc2 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-2j87-p623-8cc2?

GHSA-2j87-p623-8cc2 affects 3 products, including: go/github.com/mattermost/mattermost/server/v8:\u003e= 10.5.0, \u003c 10.5.2; go/github.com/mattermost/mattermost-plugin-msteams:\u003c= 1.15.0; go/github.com/mattermost/mattermost/server/v8:\u003c 8.0.0-20250314142426-c049748b8863.

GHSA-2j87-p623-8cc2MediumCVSS 5.3

Mattermost vulnerable to Observable Timing Discrepancy

Vendor

GitHub Security Advisories

Published

April 16, 2025

Last Modified

April 23, 2025

🔗 CVE IDs covered (1)

CVE-2025-27936 →

📋 Description

Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret comparison.

🎯 Affected products3

go/github.com/mattermost/mattermost/server/v8:>= 10.5.0, < 10.5.2
go/github.com/mattermost/mattermost-plugin-msteams:<= 1.15.0
go/github.com/mattermost/mattermost/server/v8:< 8.0.0-20250314142426-c049748b8863

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-27936
https://mattermost.com/security-updates
https://pkg.go.dev/vuln/GO-2025-3618
https://github.com/advisories/GHSA-2j87-p623-8cc2