RSS   Vulnerabilities for 'Mattermost boards'   RSS

2022-01-18
 
CVE-2021-37866

CWE-613
 

 
Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization.

 
 
CVE-2021-37867

CWE-200
 

 
Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive & private information disclosure.

 

 >>> Vendor: Mattermost 6 Products
Server
Mattermost
Mattermost server
Mattermost desktop
Mattermost boards
Playbooks


Copyright 2024, cxsecurity.com

 

Back to Top