Vulnerability · Published Apr 23, 2021 · Assigned by Vaadin

CVE-2021-31408Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19

Medium 6.3

In plain English

A medium-severity security flaw in flow-client from Vaadin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 74.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.vaadin:vaadin-bom	19.0.4	GHSA-mr8h-j9cv-4m8h

Affected products (as reported)

Vendor	Product	Versions
Vaadin	Vaadin	18.0.0 – before *
Vaadin	flow-client	5.0.0 – before *

Weakness: CWE-613 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

https://vaadin.com/security/cve-2021-31408 x_refsource_MISC
https://github.com/vaadin/flow/pull/10577 x_refsource_MISC