GHSA-75XC-QVXH-27F8 Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8

🗓️ 19 Apr 2021 14:51:06Reported by GoogleType

osv🔗 osv.dev👁 5 Views

Timing side channel in UIDL handler enables CSRF token guessing via non-constant-time comparison in Vaadin server 7 and 8.

Reporter	Title	Published	Views	Family All 13
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to sensitive information exposure (CVE-2021-31403)	20 Apr 202310:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple issues (CVE-2021-31403, CVE-2020-36320, CVE-2019-25028)	5 Apr 202311:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to sensitive information exposure (CVE-2021-31403)	4 Apr 202312:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to sensitive information exposure and denial of service (CVE-2021-31403, CVE-2021-33609)	20 Apr 202310:39	–	ibm
ATTACKERKB	CVE-2021-31403	12 Feb 202109:17	–	attackerkb
CNNVD	Vaadin framework 安全漏洞	23 Apr 202100:00	–	cnnvd
CVE	CVE-2021-31403	23 Apr 202116:05	–	cve
Cvelist	CVE-2021-31403 Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8	23 Apr 202116:05	–	cvelist
EUVD	EUVD-2021-0784	7 Oct 202500:30	–	euvd
Github Security Blog	Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8	19 Apr 202114:51	–	github

Source	Link
github	www.github.com/vaadin/framework/security/advisories/GHSA-75xc-qvxh-27f8
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-31403
github	www.github.com/vaadin/framework/pull/12188
github	www.github.com/vaadin/framework/pull/12190
vaadin	www.vaadin.com/security/cve-2021-31403

08 Nov 2023 04:05Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.14

EPSS0.00306