PT-2022-10683 · Mattermost · Mattermost Boards Plugin

Hagai Wechsler · Published 2022-01-18 · Updated 2022-02-03 · CVE-2021-37866

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost Boards plugin versions 0.10.0 and earlier

Description The issue allows an attacker to reuse an old session token for authorization because the session is not properly invalidated on the server-side when a user logs out of Boards.

Recommendations For Mattermost Boards plugin versions 0.10.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2021-37866

Affected Products

Mattermost Boards Plugin

References · 5

• 🔥 https://whitesourcesoftware.com/vulnerability-database/CVE-2021-37866 · Exploit
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37866 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37866 · Security Note
• https://t.me/cvenotify/26067 · Telegram Post