Mender blog

CVE-2021-35342 - useradm incorrect access control vulnerability

We recently discovered a vulnerability in Mender Enterprise, thanks to the security researcher Mubassir Kamdar, and we have now fixed it.

When the User Administration service was configured to cache the user's JWT token verification, the token wasn't fully invalidated on log out, making it possible to issue new API calls to the backend despite being logged out. The security issue affects Mender Enterprise 2.6.0 and 2.7.0, and we fixed it in Mender Enterprise 2.6.1 and 2.7.1. Open-source versions of Mender are not affected, as they do not include the caching features.

The security of the Mender product and our users is something we take very seriously. We will continue to look for, fix and responsibly disclose serious weaknesses in our product(s).

In the official public CVE registry, the issue's ID is CVE-2021-35342. If you have any questions or concerns, please get in touch with the Mender support if you have a support contract or email security@northern.tech.

Recent articles

How to leverage over-the-air (OTA) updates for NVIDIA Jetson Platform Services

How to leverage over-the-air (OTA) updates for NVIDIA Jetson Platform Services

To enable software installation, updates, management, and support across the Jetson device fleet and at scale – Mender, in collaboration with NVIDIA, published three critical use cases for NVIDIA developers.
Why is a robust over-the-air (OTA) update process critical in today’s digital age?

Why is a robust over-the-air (OTA) update process critical in today’s digital age?

Lessons learned from Crowdstrike: organizations must embed digital resilience throughout their device management lifecycle.
Enhancing sustainability in oil & gas: Tackling methane emissions with cutting edge solutions

Enhancing sustainability in oil & gas: Tackling methane emissions with cutting edge solutions

Discover how Kuva Systems overcame challenges in managing methane emission monitoring cameras in the oil & gas industry with advanced OTA updates and remote troubleshooting.
View more articles

Learn why leading companies choose Mender

Discover how Mender empowers both you and your customers with secure and reliable over-the-air updates for IoT devices. Focus on your product, and benefit from specialized OTA expertise and best practices.

 
sales-pipeline_295756365