CVE-2024-24774
published 2024-02-09CVE-2024-24774: Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription…
PriorityP417medium4.1CVSS 3.1
AVNACLPRHUINSCCLINAN
EPSS
0.46%
36.8th percentile
Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-plugin-jira | >= 0 < 4.0.0-rc1 | 4.0.0-rc1 |
| mattermost | mattermost | <= 8.1.7 | — |
| mattermost | mattermost_server | <= 8.1.7 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost Jira Plugin does not properly check security levels in github.com/mattermost/mattermost-plugin-jira
osv·2024-06-28
CVE-2024-24774 Mattermost Jira Plugin does not properly check security levels in github.com/mattermost/mattermost-plugin-jira
Mattermost Jira Plugin does not properly check security levels in github.com/mattermost/mattermost-plugin-jira
Mattermost Jira Plugin does not properly check security levels in github.com/mattermost/mattermost-plugin-jira.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/mattermost/mattermost-plugin-jira before v4.0.0-rc1.
OSV
Mattermost Jira Plugin does not properly check security levels
osv·2024-02-09
CVE-2024-24774 [MEDIUM] Mattermost Jira Plugin does not properly check security levels
Mattermost Jira Plugin does not properly check security levels
Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues.
GHSA
Mattermost Jira Plugin does not properly check security levels
ghsa·2024-02-09
CVE-2024-24774 [MEDIUM] CWE-863 Mattermost Jira Plugin does not properly check security levels
Mattermost Jira Plugin does not properly check security levels
Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-02-09
Published