CVE-2019-20842

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There is SQL injection by admins via SearchAllChannels.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jun 19, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-208437.5An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There are weak permissions for configuration CVE-2019-208446.5An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channeCVE-2019-208457.5An issue was discovered in Mattermost Server before 5.18.0. It allows attackers to cause a denial of service (memory consumption) via a largCVE-2019-208467.5An issue was discovered in Mattermost Server before 5.18.0. It has weak permissions for server-local file storage.CVE-2019-208475.3An issue was discovered in Mattermost Server before 5.18.0. An attacker can send a user_typing WebSocket event to any channel.CVE-2019-208487.5An issue was discovered in Mattermost Mobile Apps before 1.26.0. The Quick Reply feature mishandles crafted replies.CVE-2019-208495.3An issue was discovered in Mattermost Mobile Apps before 1.26.0. Cookie data can persist on a device after a logout.CVE-2019-20858.8In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additionaCVE-2019-208505.3An issue was discovered in Mattermost Mobile Apps before 1.26.0. A view cache can persist on a device after a logout.CVE-2019-208519.1An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to oCVE-2019-208527.5An issue was discovered in Mattermost Mobile Apps before 1.26.0. Local logging is not blocked for sensitive information (e.g., server addresCVE-2019-208539.8An issue was discovered in Mattermost Packages before 5.16.3. A Droplet could allow Internet access to a service that has a remote code exec
CVE-2019-20842: High severity, CVSS 7.2 | Vulnix