CVE-2024-24774

MediumCVSS 4.1/10Last modified Jun 17, 2026

Description

Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues.

Metrics

CVSS 3.1 4.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Feb 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-247757.5When a virtual server is enabled with VLAN group and SNAT listener is configured, undisclosed traffic can cause the Traffic Management Micro CVE-2024-247764.3Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts be CVE-2024-247778.8A cross-site request forgery (CSRF) vulnerability exists in the Web Application functionality of the LevelOne WBR-6012 R0.40e6. A specially CVE-2024-247786.5Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. CVE-2024-247796.5Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create vi CVE-2024-24789.8A vulnerability was found in BradWenqiang HR 2.0. It has been rated as critical. Affected by this issue is the function selectAll of the fil CVE-2024-247809.8Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register mal CVE-2024-247817.5An unauthenticated remote attacker can use an uncontrolled resource consumption vulnerability to DoS the affected devices through excessive CVE-2024-247824.3An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the CVE-2024-247835.9Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This CVE-2024-247847.5The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with CVE-2024-247855.4If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of