CVE-2019-20841: An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. CSRF can sometimes occur via a crafted web site for account…

PriorityP338high8.8CVSS 3.1

AVNACLPRNUIRSUCHIHAH

EPSS

0.43%

34.9th percentile

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. CSRF can sometimes occur via a crafted web site for account takeover attacks.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
mattermost	mattermost_server	< 5.9.7	5.9.7
mattermost	mattermost_server	—	—
mattermost	mattermost_server	>= 5.15.0 < 5.15.4	5.15.4
mattermost	mattermost_server	>= 5.16.0 < 5.16.4	5.16.4
mattermost	mattermost_server	>= 5.17.0 < 5.17.2	5.17.2

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

Suricata

ET EXPLOIT Hootoo TripMate Attempted Remote Command Injection Inbound

suricata·2019-06-11·CVSS 9.8

CVE-2018-20841 [CRITICAL] ET EXPLOIT Hootoo TripMate Attempted Remote Command Injection Inbound ET EXPLOIT Hootoo TripMate Attempted Remote Command Injection Inbound Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Hootoo TripMate Attempted Remote Command Injection Inbound"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/protocol.csp?function="; startswith; fast_pattern; content:"&mac=|7c|"; distance:0; reference:url,unit42.paloaltonetworks.com/new-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices/; reference:cve,CVE-2018-20841; classtype:attempted-admin; sid:2027461; rev:4; metadata:attack_target IoT, created_at 2019_06_11, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2024_04_13, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_techni

Suricata

ET EXPLOIT Hootoo TripMate Attempted Remote Command Injection Outbound

suricata·2019-06-11·CVSS 9.8

CVE-2018-20841 [CRITICAL] ET EXPLOIT Hootoo TripMate Attempted Remote Command Injection Outbound ET EXPLOIT Hootoo TripMate Attempted Remote Command Injection Outbound Rule: alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Hootoo TripMate Attempted Remote Command Injection Outbound"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/protocol.csp?function="; startswith; fast_pattern; content:"&mac=|7c|"; distance:0; reference:url,unit42.paloaltonetworks.com/new-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices/; reference:cve,CVE-2018-20841; classtype:attempted-admin; sid:2027460; rev:4; metadata:attack_target IoT, created_at 2019_06_11, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2024_04_13, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_tech