What is GHSA-qr8f-cjw7-838m?

GHSA-qr8f-cjw7-838m is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost Jira Plugin does not properly check security levels

Which CVE IDs does GHSA-qr8f-cjw7-838m cover?

GHSA-qr8f-cjw7-838m covers the following CVE IDs: CVE-2024-24774. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qr8f-cjw7-838m?

GHSA-qr8f-cjw7-838m has a CVSS v3 base score of 3.4, published by GitHub Security Advisories.

Which products are affected by GHSA-qr8f-cjw7-838m?

GHSA-qr8f-cjw7-838m affects 1 product, including: go/github.com/mattermost/mattermost-plugin-jira:\u003c 4.0.0-rc1.

GHSA-qr8f-cjw7-838mMediumCVSS 3.4

Mattermost Jira Plugin does not properly check security levels

Vendor

GitHub Security Advisories

Published

February 9, 2024

Last Modified

November 18, 2024

🔗 CVE IDs covered (1)

CVE-2024-24774 →

📋 Description

Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues.

🎯 Affected products1

go/github.com/mattermost/mattermost-plugin-jira:< 4.0.0-rc1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-24774
https://mattermost.com/security-updates
https://github.com/mattermost/mattermost-plugin-jira/commit/5f5e084d169bf6b82d5c46a7a7eb033e1a01c6de
https://github.com/advisories/GHSA-qr8f-cjw7-838m