Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313_message_archive_management.vala.
mitre·CWE-346·Published 2019-09-11