Vulnerability · Published May 5, 2021 · Assigned by Vaadin
CVE-2021-31409Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
High 7.5
In plain English
A high-severity uncontrolled resource consumption in Vaadin from Vaadin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.7%top 23.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.vaadin:vaadin-compatibility-server | 8.13.0 | GHSA-c332-w4jm-55wv |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Vaadin | Vaadin | 8.0.0 – before * |
| Vaadin | vaadin-compatibility-server | 8.0.0 – before * |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://vaadin.com/security/cve-2021-31409 x_refsource_CONFIRM
- https://github.com/vaadin/framework/issues/12240 x_refsource_CONFIRM
- https://github.com/vaadin/framework/pull/12241 x_refsource_CONFIRM