What’s Vulnerable › Vulnerabilities

CVE-2020-14423

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-06-18 · updated 2026-06-17
• Weakness: CWE-330

Description

Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOS_LOCAL_SECRET value, affecting password resets and invitations.

Affected products

• convos-chat convos: before 4.20 — fixed in 4.20

How to fix

Upgrade to a fixed version: convos-chat convos 4.20. Check the vendor advisory for mitigations.

References

• https://convos.chat/blog/2020/6/18/local-secret-got-more-secure
• https://github.com/Nordaaker/convos/commit/54d1763ac65c05aad27ad454b4e5a62ba8352d39
• https://github.com/Nordaaker/convos/compare/4.19...4.20
• https://convos.chat/blog/2020/6/18/local-secret-got-more-secure
• https://github.com/Nordaaker/convos/commit/54d1763ac65c05aad27ad454b4e5a62ba8352d39
• https://github.com/Nordaaker/convos/compare/4.19...4.20

Get alerted when CVE-2020-14423 or the next vulnerability affects your stack