← Back

CVE-2019-20844

nvd nist
Published: Jun 19, 2020Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel.

Affected (8)

Mattermost
1 product
Mattermost Server
Configuration A
8 vulnerable
Vulnerable SoftwareAffected Versions
Mattermost
Mattermost Server
Before 5.9.7
Mattermost Server
From 5.15.0 to 5.15.4
Mattermost Server
From 5.16.0 to 5.16.4
Mattermost Server
From 5.17.0 to 5.17.2
Mattermost Server
Version 5.18.0 rc1
Mattermost Server
Version 5.18.0 rc2
Mattermost Server
Version 5.18.0 rc3
Mattermost Server
Version 5.18.0 rc4

Related CWEs

CWE-924
Improper Enforcement of Message Integrity During Transmission in a Communication Channel
The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.

References (2)

Source: cve@mitre.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.