Skip to content
OpenAdvisories
Low · 3.4 CVE-2024-24774 BIT-mattermost-2024-24774EUVD-2024-0701GHSA-qr8f-cjw7-838mGO-2024-2540

Missing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin)

Published Feb 9, 2024 · Updated Aug 21, 2024 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost Package: github.com/mattermost/mattermost-plugin-jira Ecosystem: Go

Description

Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues.

Affected products

VendorProductAffectedFixed
Mattermost Mattermost ≤ 8.1.7 8.1.8

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mattermost/mattermost-plugin-jira < 4.0.0-rc1 4.0.0-rc1 GHSA-qr8f-cjw7-838m
Go github.com/mattermost/mattermost-plugin-jira all versions — GO-2024-2540

Advisories 1

References