CVE-2021-35342 - useradm incorrect access control vulnerability

We recently discovered a vulnerability in Mender Enterprise, thanks to the security researcher Mubassir Kamdar, and we have now fixed it.

When the User Administration service was configured to cache the user's JWT token verification, the token wasn't fully invalidated on log out, making it possible to issue new API calls to the backend despite being logged out. The security issue affects Mender Enterprise 2.6.0 and 2.7.0, and we fixed it in Mender Enterprise 2.6.1 and 2.7.1. Open-source versions of Mender are not affected, as they do not include the caching features.

The security of the Mender product and our users is something we take very seriously. We will continue to look for, fix and responsibly disclose serious weaknesses in our product(s).

In the official public CVE registry, the issue's ID is CVE-2021-35342. If you have any questions or concerns, please get in touch with the Mender support if you have a support contract or email security@northern.tech.

Recent articles

Transforming business: It’s “All On” for the future of IoT | Mender

Transforming business: It’s “All On” for the future of IoT

Insights from CES 2024 Billed as “the most powerful tech event in the world,” CES 2024 brought together more than 135 thousand attendees and four thousand
Full speed ahead: The software-defined vehicle of the future | Mender

Full speed ahead: The software-defined vehicle of the future

Distinguished panelists discuss infotainment and entertainment services for the software-defined vehicle. Automotive OEMs must innovate to move towards a s
The Future of the Embedded Linux Ecosystem | Mender

The Future of the Embedded Linux Ecosystem

Insights from the Linux Plumbers Conference 2023 The global Linux market is forecasted to reach $15.64 trillion by 2027, and commands usage among nearly ha
View more articles

Learn more about Mender

Explore our Resource Center to discover more about how Mender empowers both you and your customers with secure and reliable over-the-air updates for IoT devices.

 
sales-pipeline_295756365