Lucene search

Veracode Vulnerability DatabaseVERACODE:45446

HistoryFeb 12, 2024 - 11:39 a.m.

Cross-site Request Forgery (CSRF)

2024-02-1211:39:47

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site request forgery

csrf

mattermost

jira

vulnerability

software

3.5 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

13.3%

JSON

github.com/mattermost/mattermost-plugin-jira is vulnerable to Cross-site Request Forgery (CSRF). The vulnerability is due to improper logout checks, allowing an attacker to disconnect a user’s Jira connection in Mattermost by viewing a specially crafted message.

CPENameOperatorVersion
github.com/mattermost/mattermost-plugin-jirale4.0.0-rc1
github.com/mattermost/mattermost-plugin-jirale4.0.0-rc1

CPE	Name	Operator	Version
	github.com/mattermost/mattermost-plugin-jira	le	4.0.0-rc1
	github.com/mattermost/mattermost-plugin-jira	le	4.0.0-rc1

References

github.com/advisories/GHSA-4fp6-574p-fc35

github.com/mattermost/mattermost-plugin-jira/commit/f4cf4c6de017ef6aa4428d393b78f418dd84cd8e

mattermost.com/security-updates

3.5 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

13.3%

JSON

Related for VERACODE:45446