CVE-2024-23319: CSRF issue allows disconnecting a user's Jira connection through a simple post message (Jira Plugin)
Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/mattermost/mattermost-plugin-jirato a version that resolves this vulnerability.Fixed in 1.1.2-0.20230830170046-f4cf4c6de017 - Upgrade
Upgrade
Mattermost Jira Pluginto a version that resolves this vulnerability.Fixed in v4.1.0 - Upgrade
Upgrade
Mattermost Serverto a version that resolves this vulnerability.Fixed in 8.1.8
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23319?
CVE-2024-23319 has a medium severity rating due to its potential impact on user sessions.
How do I fix CVE-2024-23319?
To fix CVE-2024-23319, ensure you update Mattermost Server to a version higher than 8.1.7 and the Jira plugin to version 1.1.2-0.20230830170046-f4cf4c6de017.
Who is affected by CVE-2024-23319?
CVE-2024-23319 affects Mattermost Server versions up to 8.1.7 and the Jira plugin versions before 1.1.2-0.20230830170046-f4cf4c6de017.
What type of attack does CVE-2024-23319 enable?
CVE-2024-23319 enables logout CSRF attacks that can disconnect a user's Jira connection by viewing a crafted message.
Is there a workaround for CVE-2024-23319?
Currently, there is no official workaround for CVE-2024-23319 other than applying the recommended updates.