CVE-2019-20865: CSRF
Published Jun 19, 2020
·Updated
An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF.
Affected Software
10 affected components
Mattermost Mattermost Server<4.10.10
Mattermost Mattermost Server>=5.9.0<5.9.2
Mattermost Mattermost Server>=5.10.0<5.10.2
Mattermost Mattermost Server>=5.11.0<5.11.1
Mattermost Mattermost Server=5.12.0-rc1
Mattermost Mattermost Server=5.12.0-rc2
Mattermost Mattermost Server=5.12.0-rc3
Mattermost Mattermost Server=5.12.0-rc4
Mattermost Mattermost Server=5.12.0-rc5
Mattermost Mattermost Server=5.12.0-rc6
Event History
Jun 19, 2020
CVE Published
via MITRE·03:12 PM
Data Sourced
via MITRE·03:12 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-20865?
CVE-2019-20865 has been rated as a medium severity vulnerability.
2
How do I fix CVE-2019-20865?
To fix CVE-2019-20865, upgrade to Mattermost Server version 5.12.0 or later.
3
Which versions of Mattermost Server are affected by CVE-2019-20865?
CVE-2019-20865 affects Mattermost Server versions prior to 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10.
4
What type of vulnerability is CVE-2019-20865?
CVE-2019-20865 is identified as a Cross-Site Request Forgery (CSRF) vulnerability.
5
Is it safe to use Mattermost Server versions below 5.12.0 with CVE-2019-20865?
Using Mattermost Server versions below 5.12.0 may expose you to the CSRF vulnerability detailed in CVE-2019-20865.