CVE-2019-20844: Medium severity mattermost vulnerability
Published Jun 19, 2020
·Updated
An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel.
Affected Software
8 affected components
Mattermost Mattermost Server<5.9.7
Mattermost Mattermost Server>=5.15.0<5.15.4
Mattermost Mattermost Server>=5.16.0<5.16.4
Mattermost Mattermost Server>=5.17.0<5.17.2
Mattermost Mattermost Server=5.18.0-rc1
Mattermost Mattermost Server=5.18.0-rc2
Mattermost Mattermost Server=5.18.0-rc3
Mattermost Mattermost Server=5.18.0-rc4
Event History
Jun 19, 2020
CVE Published
via MITRE·01:26 PM
Data Sourced
via MITRE·01:26 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-20844?
CVE-2019-20844 has been classified as a medium severity vulnerability due to its potential for misuse in channel spoofing.
2
How do I fix CVE-2019-20844?
To fix CVE-2019-20844, update Mattermost Server to version 5.18.0 or later.
3
What does CVE-2019-20844 affect?
CVE-2019-20844 affects Mattermost Server versions prior to 5.18.0, along with several earlier versions.
4
Can CVE-2019-20844 lead to data breaches?
Yes, CVE-2019-20844 can potentially lead to data breaches by allowing an attacker to spoof private messaging channels.
5
Is there a workaround for CVE-2019-20844?
There is no official workaround for CVE-2019-20844; updating to a secure version is the only recommendation.