CVE-2024-23319
published 2024-02-09CVE-2024-23319: Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira…
PriorityP413low3.5CVSS 3.1
AVNACLPRLUIRSUCNINAL
EPSS
0.24%
15.8th percentile
Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-plugin-jira | >= 0 < 1.1.2-0.20230830170046-f4cf4c6de017 | 1.1.2-0.20230830170046-f4cf4c6de017 |
| mattermost | mattermost | <= 8.1.7 | — |
| mattermost | mattermost_server | <= 8.1.7 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Cross-site request forgery via logout button in github.com/mattermost/mattermost-plugin-jira
osv·2024-03-18
CVE-2024-23319 Cross-site request forgery via logout button in github.com/mattermost/mattermost-plugin-jira
Cross-site request forgery via logout button in github.com/mattermost/mattermost-plugin-jira
Cross-site request forgery via logout button in github.com/mattermost/mattermost-plugin-jira
GHSA
Mattermost Jira Plugin vulnerable to Cross-Site Request Forgery
ghsa·2024-02-09
CVE-2024-23319 [LOW] CWE-352 Mattermost Jira Plugin vulnerable to Cross-Site Request Forgery
Mattermost Jira Plugin vulnerable to Cross-Site Request Forgery
Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.
OSV
Mattermost Jira Plugin vulnerable to Cross-Site Request Forgery
osv·2024-02-09
CVE-2024-23319 [LOW] Mattermost Jira Plugin vulnerable to Cross-Site Request Forgery
Mattermost Jira Plugin vulnerable to Cross-Site Request Forgery
Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-02-09
Published