CVE-2024-23319

Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.

Published: Feb 9, 2024
Updated: May 4, 2025
CVE: CVE-2024-23319
GHSA: GHSA-4fp6-574p-fc35
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 3.5
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

CWEs:

CWE-352

Affected Software
References

Software	From	Fixed in
mattermost / mattermost_server	-	8.1.7.x
github.com/mattermost/mattermost-plugin-jira	-	1.1.2-0.20230830170046-f4cf4c6de017

https://github.com/mattermost/mattermost-plugin-jira/commit/f4cf4c6de017ef6aa4428d393b78f418dd84cd8e
https://mattermost.com/security-updates
https://pkg.go.dev/vuln/GO-2024-2539

Vulnerability Database

CVE-2024-23319