Low severity3.4NVD Advisory· Published Feb 9, 2024· Updated Jun 17, 2026
CVE-2024-24774
CVE-2024-24774
Description
Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/mattermost/mattermost-plugin-jiraGo | < 4.0.0-rc1 | 4.0.0-rc1 |
Affected products
4cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*range: <=8.1.7
- (no CPE)range: 0
- osv-coords2 versions
< 9.6.1+ 1 more
- (no CPE)range: < 9.6.1
- (no CPE)range: < 4.0.0-rc1
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-qr8f-cjw7-838mghsaADVISORY
- mattermost.com/security-updatesnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-24774ghsaADVISORY
- github.com/mattermost/mattermost-plugin-jira/commit/5f5e084d169bf6b82d5c46a7a7eb033e1a01c6deghsaWEB
- mattermost/mattermost-plugin-jiraghsaPACKAGE
News mentions
0No linked articles in our index yet.