Cross-site Request Forgery (CSRF)

2024-02-1211:39:47

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site request forgery

csrf

mattermost

jira

vulnerability

software

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

AI Score

6.6

Confidence

Low

EPSS

Percentile

13.3%

JSON

github.com/mattermost/mattermost-plugin-jira is vulnerable to Cross-site Request Forgery (CSRF). The vulnerability is due to improper logout checks, allowing an attacker to disconnect a user’s Jira connection in Mattermost by viewing a specially crafted message.