CVE-2019-20888 — Missing Release of Memory after Effective Lifetime in Server

CWE-401 — Missing Release of Memory after Effective Lifetime3 documents3 sources

Severity

7.5HIGHNVD

EPSS

0.4%

top 39.98%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mattermost Server

Timeline

PublishedJun 19

Latest updateMay 24

Description

An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service (memory consumption) via an outgoing webhook or a slash command integration.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDmattermost/mattermost_server5.5.0 — 5.5.2+3

🔴Vulnerability Details

GHSA

GHSA-xj4q-jrgv-5q6g: An issue was discovered in Mattermost Server before 5↗2022-05-24

▶

CVEList

CVE-2019-20888: An issue was discovered in Mattermost Server before 5↗2020-06-19

▶