BIT-mattermost-2024-2445

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/mattermost/BIT-mattermost-2024-2445.json

JSON Data

https://api.test.osv.dev/v1/vulns/BIT-mattermost-2024-2445

Aliases

CVE-2024-2445

Published

2024-12-16T07:15:43.784Z

Modified

2024-12-16T13:59:14.979167Z

Summary

[none]

Details

Mattermost Jira plugin versions shipped with Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to escape user-controlled outputs when generating HTML pages, which allows an attacker to perform reflected cross-site scripting attacks against the users of the Mattermost server.

Database specific

{
    "cpes": [
        "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}

References

https://mattermost.com/security-updates

Affected packages

Bitnami / mattermost

Package

Name: mattermost
Purl: pkg:bitnami/mattermost

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

8.1.0

Fixed

8.1.10

Introduced

9.2.0

Fixed

9.2.6

Introduced

9.3.0

Fixed

9.3.2

Introduced

9.4.0

Fixed

9.4.3