CVE-2024-2445CWE-74

Reflected XSS in Mattermost Jira plugin

Medium · published March 15, 2024

CVSS v3.1
6.1
EPSS
0%
Percentile
22.5
In the wild
Unconfirmed
What it is

Mattermost Jira plugin versions shipped with Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to escape user-controlled outputs when generating HTML pages, which allows an attacker to perform reflected cross-site scripting attacks against the users of the Mattermost server.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00309 · 22.5th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2024-03-15T09:19Z
EPSS history
Timeline
  • 15 MAR 09:19Z
    Reflected XSS in Mattermost Jira plugin
    cvelistv5