GHSA-4fp6-574p-fc35

ghsaUSosv

Mattermost Jira Plugin vulnerable to Cross-Site Request Forgery

view advisory published 2024-02-09Licence: CC-BY-4.0

Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-23319US	low3.5	0.24% (16th)	—	2024-02-09
Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost on…

references

External citations — patches, advisories, analysis.

https://github.com/mattermost/mattermost-plugin-jiraPACKAGE
https://github.com/mattermost/mattermost-plugin-jira/commit/f4cf4c6de017ef6aa4428d393b78f418dd84cd8eWEB
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2024-23319ADVISORY
https://pkg.go.dev/vuln/GO-2024-2539WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan