Session is not invalidated on server-side when user logged out of Boards
CVE-2021-37866

4.7MEDIUM

Key Information:

Vendor
Mattermost
Status
Mattermost Boards
Vendor
CVE Published:
18 January 2022

Summary

Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization.

Affected Version(s)

Mattermost Boards <= 0.10.0

Mattermost Boards 0.9.5

Mattermost Boards 0.8.4

References

https://mattermost.com/security-updates/
x_refsource_MISC
https://www.whitesourcesoftware.com/vulnerability-databas...
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hagai Wechsler from WhiteSource
.