### [CVE-2024-2445](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2445)
![](https://img.shields.io/static/v1?label=Product&message=Mattermost&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=8.1.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=9.2.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=9.3.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=9.4.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-74%3A%20Improper%20Neutralization%20of%20Special%20Elements%20in%20Output%20Used%20by%20a%20Downstream%20Component%20('Injection')&color=brightgreen)

### Description

Mattermost Jira plugin versions shipped with Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to escape user-controlled outputs when generating HTML pages, which allows an attacker to perform reflected cross-site scripting attacks against the users of the Mattermost server.

### POC

#### Reference
- https://mattermost.com/security-updates

#### Github
No PoCs found on GitHub currently.