GCVE - cpe:2.3:a:northern.tech:mender:*:*:*:*:enterprise:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:northern.tech:mender:*:*:*:*:enterprise:*:*:*

part: a version: * update: *

Vendor	Northern.Tech (`0f007064-8d3c-553e-8c6a-34471f428a50`)
Product	Mender (`a66551fe-35f9-55a8-9a45-a21d2f8489c7`)
Edition	*
Language	*
Software edition	enterprise
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-46947`	vulnerable	2026-06-08 06:48:10.900866	Details available Northern.tech Mender before 3.6.6 and 3.7.x before 3.7.7 allows SSRF. Published: 2024-11-08T00:00:00.000Z Updated: 2024-11-08T18:50:54.537Z Open on db.gcve.eu Reference links https://mender.io/blog/cve-2024-46947-cve-2024-47190-ssrf-issues-in-mender-enterprise-server	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-37019`	vulnerable	2026-06-08 06:39:46.183374	Details available Northern.tech Mender Enterprise before 3.6.4 and 3.7.x before 3.7.4 has Weak Authentication. Published: 2024-06-03T18:02:10.198Z Updated: 2025-02-13T15:59:47.489Z Open on db.gcve.eu Reference links https://northern.tech https://mender.io/blog/cve-2024-37019-account-takeover-using-saml	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-29555`	vulnerable	2026-06-08 05:42:48.485119	Details available The Deviceconnect microservice through 1.3.0 in Northern.tech Mender Enterprise before 3.2.2. allows Cross-Origin Websocket Hijacking. Published: 2022-04-28T19:44:49.000Z Updated: 2024-08-03T06:26:06.100Z Open on db.gcve.eu Reference links https://northern.tech https://mender.io/blog/cve-2022-29555-and-cve-2022-29556-vulnerabilities-in-iot-manager-and-deviceconnect	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-35342`	not_vulnerable	2026-06-08 05:32:48.649036	Details available The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows users to access the system with their JWT token after logout, because of missing invalidation (if the JWT verification cache is enabled). Published: 2021-08-27T09:52:16.000Z Updated: 2024-08-04T00:33:51.312Z Open on db.gcve.eu Reference links https://northern.tech/our-products https://mender.io/blog/cve-2021-35342-useradm-logout-vulnerabililty	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.