CVE-2021-31408

{"containers": {"cna": {"affected": [{"product": "Vaadin", "vendor": "Vaadin", "versions": [{"changes": [{"at": "19.0.0", "status": "unaffected"}, {"at": "19.0.0", "status": "affected"}], "lessThan": "*", "status": "affected", "version": "18.0.0", "versionType": "custom"}]}, {"product": "flow-client", "vendor": "Vaadin", "versions": [{"changes": [{"at": "6.0.0", "status": "unaffected"}, {"at": "6.0.0", "status": "affected"}], "lessThan": "*", "status": "affected", "version": "5.0.0", "versionType": "custom"}]}], "datePublic": "2021-04-20T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-613", "description": "CWE-613 Insufficient Session Expiration", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-04-23T16:07:16.000Z", "orgId": "9e0f3122-90e9-42d5-93de-8c6b98deef7e", "shortName": "Vaadin"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://vaadin.com/security/cve-2021-31408"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/vaadin/flow/pull/10577"}], "source": {"discovery": "INTERNAL"}, "title": "Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"AKA": "", "ASSIGNER": "security@vaadin.com", "DATE_PUBLIC": "2021-04-20T08:17:00.000Z", "ID": "CVE-2021-31408", "STATE": "PUBLIC", "TITLE": "Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Vaadin", "version": {"version_data": [{"platform": "", "version_affected": ">=", "version_name": "", "version_value": "18.0.0"}, {"platform": "", "version_affected": "<", "version_name": "", "version_value": "19.0.0"}, {"platform": "", "version_affected": ">=", "version_name": "", "version_value": "19.0.0"}, {"platform": "", "version_affected": "<=", "version_name": "", "version_value": "19.0.3 +1"}]}}, {"product_name": "flow-client", "version": {"version_data": [{"platform": "", "version_affected": ">=", "version_name": "", "version_value": "5.0.0"}, {"platform": "", "version_affected": "<", "version_name": "", "version_value": "6.0.0"}, {"platform": "", "version_affected": ">=", "version_name": "", "version_value": "6.0.0"}, {"platform": "", "version_affected": "<=", "version_name": "", "version_value": "6.0.4 +1"}]}}]}, "vendor_name": "Vaadin"}]}}, "configuration": [], "credit": [], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out."}]}, "exploit": [], "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-613 Insufficient Session Expiration"}]}]}, "references": {"reference_data": [{"name": "https://vaadin.com/security/cve-2021-31408", "refsource": "MISC", "url": "https://vaadin.com/security/cve-2021-31408"}, {"name": "https://github.com/vaadin/flow/pull/10577", "refsource": "MISC", "url": "https://github.com/vaadin/flow/pull/10577"}]}, "solution": [], "source": {"advisory": "", "defect": [], "discovery": "INTERNAL"}, "work_around": []}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T22:55:53.814Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://vaadin.com/security/cve-2021-31408"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/vaadin/flow/pull/10577"}]}]}, "cveMetadata": {"assignerOrgId": "9e0f3122-90e9-42d5-93de-8c6b98deef7e", "assignerShortName": "Vaadin", "cveId": "CVE-2021-31408", "datePublished": "2021-04-23T16:07:16.629Z", "dateReserved": "2021-04-15T00:00:00.000Z", "dateUpdated": "2024-09-17T02:06:19.701Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Vaadin", "vendor": "Vaadin", "versions": [{"changes": [{"at": "19.0.0", "status": "unaffected"}, {"at": "19.0.0", "status": "affected"}], "lessThan": "*", "status": "affected", "version": "18.0.0", "versionType": "custom"}]}, {"product": "flow-client", "vendor": "Vaadin", "versions": [{"changes": [{"at": "6.0.0", "status": "unaffected"}, {"at": "6.0.0", "status": "affected"}], "lessThan": "*", "status": "affected", "version": "5.0.0", "versionType": "custom"}]}], "source": "security@vaadin.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*", "matchCriteriaId": "138C0A40-EC8F-4F6F-B907-1F5282B83958", "versionEndExcluding": "6.0.0", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*", "matchCriteriaId": "B9CCDECF-655E-48E5-ADEC-F5189C6E043D", "versionEndExcluding": "6.0.5", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "matchCriteriaId": "74A5FA0C-C1AE-496E-8601-A9CC193F750E", "versionEndExcluding": "19.0.4", "versionStartIncluding": "19.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vaadin:vaadin:18.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "B0C90C81-A26F-4686-BC0C-6D86C3620F5C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out."}, {"lang": "es", "value": "El asistente Authentication.logout() en com.vaadin:flow-client versiones 5.0.0 anteriores a 6.0.0 (Vaadin 18) y versiones 6.0.0 hasta 6.0.4 (versiones Vaadin 19.0.0 hasta 19.0.3) usan un m\u00e9todo HTTP incorrecto , que, en combinaci\u00f3n con la protecci\u00f3n CSRF de Spring Security, permite a atacantes locales acceder a endpoints de Fusion despu\u00e9s de que el usuario intenta cerrar la sesi\u00f3n"}], "id": "CVE-2021-31408", "lastModified": "2026-06-17T03:51:43.580", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 3.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.2, "source": "security@vaadin.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-04-23T17:15:08.260", "references": [{"source": "security@vaadin.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/vaadin/flow/pull/10577"}, {"source": "security@vaadin.com", "tags": ["Vendor Advisory"], "url": "https://vaadin.com/security/cve-2021-31408"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/vaadin/flow/pull/10577"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://vaadin.com/security/cve-2021-31408"}], "sourceIdentifier": "security@vaadin.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "security@vaadin.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-613"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}