CVE-2021-37866 — Session is not invalidated on server-side when user logged out of Boards

CVE-2021-37866

Session is not invalidated on server-side when user logged out of Boards PUBLISHED

Description (CNA)

Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost Boards	affected unspecified through 0.10.0; unaffected 0.9.5 before unspecified; unaffected 0.8.4 before unspecified; unaffected 0.7.5 before unspecified

CWE

CWE-613

References

https://mattermost.com/security-updates/
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-37866

ADP enrichment

CVE

No English description supplied.

https://mattermost.com/security-updates/
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-37866

CISA-ADP

No English description supplied.

No references supplied.