CVE-2024-2445 — Injection in Server

CWE-74 — InjectionCWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.4%
top 37.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mattermost ServerMattermost
Timeline
PublishedMar 15

Description

Mattermost Jira plugin versions shipped with Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to escape user-controlled outputs when generating HTML pages, which allows an attacker to perform reflected cross-site scripting attacks against the users of the Mattermost server.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDmattermost/mattermost_server8.1.0 — 8.1.10+3
▶CVEListV5mattermost/mattermost9.4.0 — 9.4.2+3

🔴Vulnerability Details

2
CVEList
Reflected XSS in Mattermost Jira plugin↗2024-03-15
▶
GHSA
GHSA-m6gm-m2m7-vwxg: Mattermost Jira plugin versions shipped with Mattermost versions 8↗2024-03-15
▶
CVE-2024-2445 — Injection in Mattermost Server | cvebase