CVE-2021-35342 - The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows users to access the system with their JWT token after logout, because of missing invalidation (if the JWT verification cache is enabled)

Back Back to CVE browser

HIGH

The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows users to access the system with their JWT token after logout, because of missing invalidation (if the JWT verification cache is enabled)

Published Aug 27, 2021

7.5

HIGH

CVSS 3.1

EPSS 1.11%

Description

The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows users to access the system with their JWT token after logout, because of missing invalidation (if the JWT verification cache is enabled).

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-613

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-21985
Advisory
https://mender.io/blog/cve-2021-35342-useradm-logout-vulnerabililty
x_refsource_MISCThird Party Advisory
https://northern.tech/our-products
x_refsource_MISCProductVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-21985		Advisory
https://mender.io/blog/cve-2021-35342-useradm-logout-vulnerabililty		x_refsource_MISCThird Party Advisory
https://northern.tech/our-products		x_refsource_MISCProductVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Aug 27, 2021

Updated Aug 4, 2024

Reserved Jun 23, 2021

Link CVE-2021-35342

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2021-35342

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Aug 27, 2021

Updated Aug 4, 2024

Link EUVD-2021-21985

GitHub

No data