Lucene search

[email protected]CVE-2021-31404

HistoryApr 23, 2021 - 4:15 p.m.

CVE-2021-31404

2021-04-2316:15:08

CWE-208

CWE-203

[email protected]

web.nvd.nist.gov

cve-2021-31404

security

csrf

vaadin

timing attack

vulnerability

nvd

1.9 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

3.6 Low

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

JSON

Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaadin 15 prior to 18), and 5.0.0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack.

Affected configurations

NVD

Node

vaadinflowRange1.0.0–1.0.14

vaadinflowRange1.1.0–2.0.0

vaadinflowRange2.0.0–2.4.7

vaadinflowRange3.0.0–5.0.0

vaadinflowRange5.0.0–5.0.3

vaadinvaadinRange10.0.0–10.0.17

vaadinvaadinRange11.0.0–14.0.0

vaadinvaadinRange14.0.0–14.4.7

vaadinvaadinRange15.0.0–17.0.0

vaadinvaadinRange18.0.0–18.0.6

CPENameOperatorVersion
vaadin:flowvaadin flowlt1.0.14
vaadin:flowvaadin flowlt2.0.0
vaadin:flowvaadin flowlt2.4.7
vaadin:flowvaadin flowlt5.0.0
vaadin:flowvaadin flowlt5.0.3
vaadin:vaadinvaadinlt10.0.17
vaadin:vaadinvaadinlt14.0.0
vaadin:vaadinvaadinlt14.4.7
vaadin:vaadinvaadinlt17.0.0
vaadin:vaadinvaadinlt18.0.6

CPE	Name	Operator	Version
vaadin:flow	vaadin flow	lt	1.0.14
vaadin:flow	vaadin flow	lt	2.0.0
vaadin:flow	vaadin flow	lt	2.4.7
vaadin:flow	vaadin flow	lt	5.0.0
vaadin:flow	vaadin flow	lt	5.0.3
vaadin:vaadin	vaadin	lt	10.0.17
vaadin:vaadin	vaadin	lt	14.0.0
vaadin:vaadin	vaadin	lt	14.4.7
vaadin:vaadin	vaadin	lt	17.0.0
vaadin:vaadin	vaadin	lt	18.0.6

CNA Affected

[
  {
    "product": "Vaadin",
    "vendor": "Vaadin",
    "versions": [
      {
        "changes": [
          {
            "at": "11.0.0",
            "status": "affected"
          },
          {
            "at": "14.0.0",
            "status": "unaffected"
          },
          {
            "at": "14.0.0",
            "status": "affected"
          },
          {
            "at": "15.0.0",
            "status": "affected"
          },
          {
            "at": "18.0.0",
            "status": "unaffected"
          },
          {
            "at": "18.0.0",
            "status": "affected"
          }
        ],
        "lessThan": "*",
        "status": "affected",
        "version": "10.0.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "flow-server",
    "vendor": "Vaadin",
    "versions": [
      {
        "changes": [
          {
            "at": "1.1.0",
            "status": "affected"
          },
          {
            "at": "2.0.0",
            "status": "unaffected"
          },
          {
            "at": "2.0.0",
            "status": "affected"
          },
          {
            "at": "3.0.0",
            "status": "affected"
          },
          {
            "at": "5.0.0",
            "status": "unaffected"
          },
          {
            "at": "5.0.0",
            "status": "affected"
          }
        ],
        "lessThan": "*",
        "status": "affected",
        "version": "1.0.0",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/vaadin/flow/pull/9875

vaadin.com/security/cve-2021-31404

Social References

1.9 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

3.6 Low

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

JSON

Related for CVE-2021-31404

veracode1 github2 osv3 prion1 cvelist1 nvd1 vaadin1