What is CVE-2021-35342?

CVE-2021-35342 is a high-severity vulnerability in Northern.tech Mender, classified under Insufficient Session Expiration. CVSS score: 7.5/10. Published 2021-08-27.

How severe is CVE-2021-35342?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Northern.tech Mender

CVE-2021-35342

The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows users to access the system with their JWT token after logout, because of missing invalidation (if the JWT verification cache is enabled).

EPSS: 0.011 (62.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Northern.tech Mender
Northern.tech Useradm — versions 1.14.0, 1.13.0
N/a — versions n/a

Weakness classification (CWE)

CWE-613 — Insufficient Session Expiration

References

cve@mitre.org (Product, x_refsource_MISC, Vendor Advisory)
cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-35342?: CVE-2021-35342 is a high-severity vulnerability in Northern.tech Mender, classified under Insufficient Session Expiration. CVSS score: 7.5/10. Published 2021-08-27.
How severe is CVE-2021-35342?: High severity. CVSS v3 base score is 7.5 out of 10.