PT-2021-19284 · Vaadin · Vaadin-Server

Xhelal Likaj · Published 2021-04-19 · Updated 2021-04-30 · CVE-2021-31403

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 com.vaadin:vaadin-server versions 8.0.0 through 8.12.2

Description The issue is related to a non-constant-time comparison of CSRF tokens in the UIDL request handler. This allows an attacker to guess a security token via a timing attack.

Recommendations For versions 7.0.0 through 7.7.23, update to a version outside of this range to mitigate the risk. For versions 8.0.0 through 8.12.2, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider implementing constant-time comparison for CSRF tokens in the UIDL request handler until a patch is available.

Fix

Side Channel Attack

Weakness Enumeration

CWE-208

CWE-203

Related Identifiers

CVE-2021-31403

GHSA-75XC-QVXH-27F8

Affected Products

Vaadin-Server

References · 7

• https://github.com/vaadin/framework/pull/12188 · Patch
• https://github.com/vaadin/framework/pull/12190 · Patch
• https://vaadin.com/security/cve-2021-31403 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31403 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31403 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-75xc-qvxh-27f8 · Vendor Advisory
• https://github.com/vaadin/framework/security/advisories/GHSA-75xc-qvxh-27f8 · Note