CVE-2024-23319

Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://mattermost.com/security-updates	Vendor Advisory
https://mattermost.com/security-updates	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:57

Type	Values Removed	Values Added
References	~~() https://mattermost.com/security-updates - Vendor Advisory~~	() https://mattermost.com/security-updates - Vendor Advisory

15 Feb 2024, 18:44

Type	Values Removed	Values Added
CPE		cpe:2.3:a:mattermost:mattermost_server::::::::
References	~~() https://mattermost.com/security-updates -~~	() https://mattermost.com/security-updates - Vendor Advisory
Summary		(es) El complemento Mattermost Jira no protege contra el cierre de sesión CSRF, lo que permite a un atacante publicar un mensaje especialmente manipulado que desconectaría la conexión Jira de un usuario en Mattermost solo al ver el mensaje.
First Time		Mattermost mattermost Server Mattermost

09 Feb 2024, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-02-09 15:15

Updated : 2024-11-21 08:57

NVD link : CVE-2024-23319

Mitre link : CVE-2024-23319

CVE.ORG link : CVE-2024-23319

JSON object : View

Products Affected

mattermost

mattermost_server

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2024-23319", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}]}, "published": "2024-02-09T15:15:08.133", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "responsibledisclosure@mattermost.com"}, {"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-352"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's\u00a0Jira connection in Mattermost only by viewing the message."}, {"lang": "es", "value": "El complemento Mattermost Jira no protege contra el cierre de sesi\u00f3n CSRF, lo que permite a un atacante publicar un mensaje especialmente manipulado que desconectar\u00eda la conexi\u00f3n Jira de un usuario en Mattermost solo al ver el mensaje."}], "lastModified": "2024-11-21T08:57:29.683", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C15FCA4-0D78-4869-B363-E7BE70D01A40", "versionEndIncluding": "8.1.7"}], "operator": "OR"}]}], "sourceIdentifier": "responsibledisclosure@mattermost.com"}