github.com/mattermost/mattermost-plugin-jira

3 results · Feed

• High 7.2
  CVE-2025-14273

  Mattermost Jira plugin user spoofing enables Jira request forgery.

  Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which al…

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Dec 22, 2025
• Low 3.4
  CVE-2024-24774

  Missing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin)

  Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Ji…

  Mattermost Mattermost github.com/mattermost/mattermost-plugin-jira Go
  Feb 9, 2024
• Low 3.5
  CVE-2024-23319

  CSRF issue allows disconnecting a user's Jira connection through a simple post message (Jira Plugin)

  Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.

  Mattermost Mattermost github.com/mattermost/mattermost-plugin-jira Go
  Feb 9, 2024