GitHub Advisoryadvisory · Go

GHSA-4fp6-574p-fc35 Mattermost Jira Plugin vulnerable to Cross-Site Request Forgery

LOW Published 2024-02-09 Modified 2024-03-18 Official page ↗
Aliases
CVE-2024-23319
Ecosystem
Go
Packages
github.com/mattermost/mattermost-plugin-jira
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Weaknesses
CWE-352
Reviewed
2024-02-09

Affected packages

• Go github.com/mattermost/mattermost-plugin-jira: < 1.1.2-0.20230830170046-f4cf4c6de017 → fixed in 1.1.2-0.20230830170046-f4cf4c6de017

Description

Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.

Related

Alias · CVE (1)

  • CVE-2024-23319 Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References