CVE-2021-31404

Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaadin 15 prior to 18), and 5.0.0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack.

CVSS v3 2.5 LOW
CVSS v2.0 1.9 LOW

2.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.0 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

1.9^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/vaadin/flow/pull/9875	Patch Third Party Advisory
https://vaadin.com/security/cve-2021-31404	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vaadin:flow::::::::
	cpe:2.3:a:vaadin:flow::::::::
	cpe:2.3:a:vaadin:flow::::::::
	cpe:2.3:a:vaadin:flow::::::::
	cpe:2.3:a:vaadin:flow::::::::
	cpe:2.3:a:vaadin:vaadin::::::::
	cpe:2.3:a:vaadin:vaadin::::::::
	cpe:2.3:a:vaadin:vaadin::::::::
	cpe:2.3:a:vaadin:vaadin::::::::
	cpe:2.3:a:vaadin:vaadin::::::::

History

30 Apr 2021, 19:00

Type	Values Removed	Values Added
CPE		cpe:2.3:a:vaadin:flow:::::::: cpe:2.3:a:vaadin:vaadin::::::::
References	~~(CONFIRM) https://vaadin.com/security/cve-2021-31404 -~~	(CONFIRM) https://vaadin.com/security/cve-2021-31404 - Vendor Advisory
References	~~(CONFIRM) https://github.com/vaadin/flow/pull/9875 -~~	(CONFIRM) https://github.com/vaadin/flow/pull/9875 - Patch, Third Party Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 1.9 v3 : 2.5
CWE		CWE-203

23 Apr 2021, 16:30

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-04-23 16:15

Updated : 2023-12-10 13:55

NVD link : CVE-2021-31404

Mitre link : CVE-2021-31404

CVE.ORG link : CVE-2021-31404

JSON object : View

Products Affected

vaadin

flow
vaadin

CWE

CWE-203

Observable Discrepancy

CWE-208

Observable Timing Discrepancy

{"id": "CVE-2021-31404", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.5, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.0}, {"type": "Secondary", "source": "security@vaadin.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.4}]}, "published": "2021-04-23T16:15:08.647", "references": [{"url": "https://github.com/vaadin/flow/pull/9875", "tags": ["Patch", "Third Party Advisory"], "source": "security@vaadin.com"}, {"url": "https://vaadin.com/security/cve-2021-31404", "tags": ["Vendor Advisory"], "source": "security@vaadin.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-203"}]}, {"type": "Secondary", "source": "security@vaadin.com", "description": [{"lang": "en", "value": "CWE-208"}]}], "descriptions": [{"lang": "en", "value": "Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaadin 15 prior to 18), and 5.0.0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack."}, {"lang": "es", "value": "La comparaci\u00f3n non-constant-time de tokens CSRF en el manejador de peticiones UIDL en com.vaadin:flow-server versiones 1.0.0 hasta 1.0.13 (Vaadin versiones 10.0.0 hasta 10.0.16), versiones 1.1.0 anteriores a 2.0.0 (Vaadin versiones 11 anteriores a 14), versiones 2.0.0 hasta 2.4.6 (Vaadin versiones 14.0.0 hasta 14.4.6), versiones 3.0.0 anteriores a 5.0.0 (Vaadin versiones 15 anteriores a 18) y versiones 5.0.0 hasta 5.0.2 (Vaadin versiones 18.0.0 hasta 18.0.5), permite al atacante adivinar un token de seguridad por medio de un ataque de sincronizaci\u00f3n"}], "lastModified": "2021-04-30T19:00:46.753", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B6B73DE-1089-401A-8E6E-31938A277F6F", "versionEndExcluding": "1.0.14", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA762C83-724A-4D14-B4C4-9824799B2999", "versionEndExcluding": "2.0.0", "versionStartIncluding": "1.1.0"}, {"criteria": "cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "409F92E2-6634-4596-BD66-FBD46E45E658", "versionEndExcluding": "2.4.7", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "796C0FAD-172F-4186-847E-5312F3664734", "versionEndExcluding": "5.0.0", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53839127-7CF7-4BDC-BC21-29DF165B2BB0", "versionEndExcluding": "5.0.3", "versionStartIncluding": "5.0.0"}, {"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18A7C1CA-ED82-43FD-A3FC-68CC66D17B96", "versionEndExcluding": "10.0.17", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06E47D63-52A7-4B6A-B90F-7692D854DECC", "versionEndExcluding": "14.0.0", "versionStartIncluding": "11.0.0"}, {"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C13F08D0-2AB9-4B27-B023-59B9F43626F6", "versionEndExcluding": "14.4.7", "versionStartIncluding": "14.0.0"}, {"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D0B97C7-D17B-4006-AFE6-707F1290E39E", "versionEndExcluding": "17.0.0", "versionStartIncluding": "15.0.0"}, {"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C06D13A9-529D-4523-BA83-AC217FF63808", "versionEndExcluding": "18.0.6", "versionStartIncluding": "18.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vaadin.com"}