4.7
Medium
CVE-2021-37866 Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out…
Description
Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Mattermost Boards 0.10 | earliest → 0.10.0 | No fix stated |
| Mattermost Boards 0.9 | earliest → < 0.9.5 | 0.9.5 |
| Mattermost Boards 0.8 | earliest → < 0.8.4 | 0.8.4 |
| Mattermost Boards 0.7 | earliest → < 0.7.5 | 0.7.5 |