← Back

CVE-2019-20865

nvd nist
Published: Jun 19, 2020Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF.

Affected (10)

Mattermost
1 product
Mattermost Server
Configuration A
10 vulnerable
Vulnerable SoftwareAffected Versions
Mattermost
Mattermost Server
version < 4.10.10
Mattermost Server
5.10.0 ≤ version < 5.10.2
Mattermost Server
5.11.0 ≤ version < 5.11.1
Mattermost Server
5.9.0 ≤ version < 5.9.2
Mattermost Server
Version 5.12.0 rc1
Mattermost Server
Version 5.12.0 rc2
Mattermost Server
Version 5.12.0 rc3
Mattermost Server
Version 5.12.0 rc4
Mattermost Server
Version 5.12.0 rc5
Mattermost Server
Version 5.12.0 rc6

Related CWEs

CWE-352
Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (2)

Source: cve@mitre.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.