Insomnia1102

**Name of the Vulnerable Software and Affected Versions** Mattermost version 11.7.0 Mattermost version 11.6.2 Mattermost version 11.5.5 Mattermost version 10.11.17 **Description** Remote unauthenticated attackers can inject a rogue `sharedSecret` and disrupt the Jira integration. This occurs during the pending-install window via a POST request to the '/ac/installed' endpoint because the software fails to authenticate Atlassian Connect installed callbacks. **Recommendations** Update Mattermost version 11.7.0 to a newer version. Update Mattermost version 11.6.2 to a newer version. Update Mattermost version 11.5.5 to a newer version. Update Mattermost version 10.11.17 to a newer version.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions prior to 11.6.2 Mattermost versions prior to 11.5.5 Mattermost versions prior to 10.11.17 **Description** A failure to validate that a username returned during bot registration belongs to a bot account allows an unprivileged attacker to intercept private messages sent by plugins via direct message channels. This is achieved by pre-registering a user account with a predictable plugin bot username. **Recommendations** Update to version 11.6.2 or later. Update to version 11.5.5 or later. Update to version 10.11.17 or later.