CVE-2021-31403

LOW
Published Apr 23, 20215y ago · Modified Jun 17, 20262w ago
2.5 CVSS 3.1
Low
Find Similar
Published Apr 23, 2021 5y ago
Last Modified Jun 17, 2026 2w ago

Description

Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security token via timing attack

CVSS Details

Base Score
2.5
Exploitability
1.0
Impact
1.4
Vector string
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector Local
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-203
CWE-208

Affected Products 2

VendorProductVersionRange
vaadinvaadin*≥7.0.0  –  <7.7.24
vaadinvaadin*≥8.0.0  –  <8.12.3

References 3

  • github.com https://github.com/vaadin/framework/pull/12188
    PatchThird Party Advisory
  • github.com https://github.com/vaadin/framework/pull/12190
    PatchThird Party Advisory
  • vaadin.com https://vaadin.com/security/cve-2021-31403
    Vendor Advisory

Remediation

  • github.com https://github.com/vaadin/framework/pull/12188
    PatchThird Party Advisory
  • github.com https://github.com/vaadin/framework/pull/12190
    PatchThird Party Advisory