Vulnerability DatabaseCVE-2024-23319

CVE-2024-23319:
vulnerability analysis and mitigation

Overview

Mattermost Jira Plugin contains a Cross-Site Request Forgery (CSRF) vulnerability that affects versions up to 8.1.7. The vulnerability was discovered and disclosed on February 9, 2024. This security flaw allows an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost simply by viewing the message (NVD).

Technical details

The vulnerability has been assigned a CVSS v3.1 Base Score of 3.5 (LOW) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L. The vulnerability is classified as CWE-352: Cross-Site Request Forgery (CSRF). The technical nature of the vulnerability involves the lack of CSRF protection in the Jira Plugin's logout functionality, which can be exploited through message viewing (NVD).

Impact

When exploited, this vulnerability allows an attacker to disconnect a user's Jira connection in Mattermost. The impact is limited to availability (A:L in CVSS score) with no direct impact on confidentiality or integrity of the system. The attack requires user interaction (UI:R) as the victim needs to view the specially crafted message (NVD).

Mitigation and workarounds

The vulnerability affects Mattermost Server versions up to 8.1.7. Users are advised to upgrade to the latest version of Mattermost Server that includes the security fix (Mattermost Advisory).