CVE-2019-20877

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information about whether someone has 2FA enabled.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jun 19, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-208784.3An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Changes, within the application, to e-mail addresses arCVE-2019-208794.3An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. Changes to e-mail addresses do not require credential rCVE-2019-20885.5In StatsService, there is a possible out of bounds read. This could lead to local information disclosure if UBSAN were not enabled, with no CVE-2019-208807.5An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. It allows attackers to cause a denial of service (memorCVE-2019-208817.3An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA.CVE-2019-208825.3An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an opCVE-2019-208834.3An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post.CVE-2019-208845.3An issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially attach a file to more than one post.CVE-2019-208857.5An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file.CVE-2019-208867.5An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin.CVE-2019-208874.3An issue was discovered in Mattermost Server before 5.7.1, 5.6.4, 5.5.3, and 4.10.6. It does not honor flags API permissions when deciding wCVE-2019-208887.5An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service (memory
CVE-2019-20877: Medium severity, CVSS 5.3 | Vulnix