CVE-2021-37867mediumCWE-200

CVE-2021-37867: medium-severity vulnerability in Mattermost Boards

Emails of all users are exposed via one of the Boards APIs

Published · Updated

Follow this CVE+ Monitor Mattermost Boards

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.7%
Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive & private information disclosure.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
Mattermost · Mattermost Boards
Related CVEs — Mattermost Boards

In the same product, most dangerous first.

CVE-2021-37866MEDIUMSession is not invalidated on server-side when user logged out of BoardsEPSS 0.7%