Riskcovery

CVE-2021-37866

Session is not invalidated on server-side when user logged out of Boards

State
Published
Severity
4.7 Medium
Published
Jan 18, 2022
Updated
Dec 6, 2024
Reserved
Aug 2, 2021

Read the record on cve.org

Description

Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization.

Scores

CVSSScoreVectorSource
3.14.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NMattermost

Weaknesses

  • CWE-613 Insufficient Session Expiration

Affected Products

ProductVersions
Mattermost BoardsMattermost
  • 0.10.0 and earlierAffected
  • 0.9.5 to before unspecifiedNot affected
  • 0.8.4 to before unspecifiedNot affected
  • 0.7.5 to before unspecifiedNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.