CVSS 3.1
4.1 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:NCVE-2024-24774
Medium (4.1) in mattermost mattermost server. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost-plugin-jira 4.0.0-rc1.
Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mattermost:mattermost_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qr8f-cjw7-838m | Go | github.com/mattermost/mattermost-plugin-jira | <4.0.0-rc1 | 4.0.0-rc1 |
| GO-2024-2540 | Go | github.com/mattermost/mattermost-plugin-jira | all versions | no fix published |