PT-2024-19806 · Mattermost · Mattermost Jira Plugin

Rohitesh Gupta · Published 2024-02-09 · Updated 2024-03-18 · CVE-2024-23319

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Mattermost Jira Plugin (affected versions not specified)

Description The Mattermost Jira Plugin fails to protect against logout CSRF, allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost by simply viewing the message. This issue can be exploited via a cross-site request forgery vulnerability in the logout button.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BIT-MATTERMOST-2024-23319

CVE-2024-23319

GHSA-4FP6-574P-FC35

GO-2024-2539

Affected Products

Mattermost Jira Plugin

References · 13

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23319 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4fp6-574p-fc35 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mattermost-2024-23319 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23319 · Security Note
• https://osv.dev/vulnerability/GO-2024-2539 · Vendor Advisory
• https://github.com/mattermost/mattermost-plugin-jira · Note
• https://github.com/mattermost/mattermost-plugin-jira/commit/f4cf4c6de017ef6aa4428d393b78f418dd84cd8e · Note
• https://pkg.go.dev/vuln/GO-2024-2539 · Note
• https://twitter.com/CVEnew/status/1755967933468000669 · Twitter Post
• https://t.me/cvenotify/70821 · Telegram Post
• https://t.me/cvenotify/70848 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1756009439885156856 · Twitter Post