CVE-2019-20855

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information (local files) during legacy attachment migration.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jun 19, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-208569.8An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection.CVE-2019-208577.5An issue was discovered in Mattermost Server before 5.16.0. It allows attackers to cause a denial of service (markdown renderer hang) via maCVE-2019-208587.5An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service (CPU consumption) via crafted cCVE-2019-208597.5An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input.CVE-2019-20868.8In libxaac, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additionCVE-2019-208605.5An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of serviCVE-2019-208618.8An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted link.CVE-2019-208627.5An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands.CVE-2019-208637.5An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted.CVE-2019-208647.5An issue was discovered in Mattermost Plugins before 5.13.0. The GitHub plugin allows an attacker to attach his Mattermost account to a diffCVE-2019-208658.8An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF.CVE-2019-208665.3An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet heade
CVE-2019-20855: High severity, CVSS 7.5 | Vulnix