CVE-2024-24774

Missing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin)

State: Published
Severity: 3.4 Low
Published: Feb 9, 2024
Updated: Aug 21, 2024
Reserved: Jan 30, 2024

Description

Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues.

Scores

CVSS	Score	Vector	Source
3.1	3.4 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N	Mattermost

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
MattermostMattermost	8.1.7 and earlierAffected 8.1.8Not affected

References

https://mattermost.com/security-updates

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.