Skip to content
CVE PROGRAM SOURCE RECORD4.7 Medium

CVE-2021-37866

Session is not invalidated on server-side when user logged out of Boards

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mattermost

Description

Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost Boards

  • unspecified to ≤ 0.10.0affected
  • 0.9.5 to < unspecifiedunaffected
  • 0.8.4 to < unspecifiedunaffected
  • 0.7.5 to < unspecifiedunaffected

References