GitHub Advisoryadvisory · Go

GHSA-qr8f-cjw7-838m Mattermost Jira Plugin does not properly check security levels

MEDIUM Published 2024-02-09 Modified 2024-11-18 Official page ↗
Aliases
CVE-2024-24774
Ecosystem
Go
Packages
github.com/mattermost/mattermost-plugin-jira
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N
Weaknesses
CWE-863
Reviewed
2024-02-09

Affected packages

• Go github.com/mattermost/mattermost-plugin-jira: < 4.0.0-rc1 → fixed in 4.0.0-rc1

Description

Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues.

Related

Alias · CVE (1)

  • CVE-2024-24774 Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References