PT-2021-19286 · Vaadin · Vaadin-Text-Field-Flow

Published 2021-04-19 · Updated 2021-05-05 · CVE-2021-31405

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 com.vaadin:vaadin-text-field-flow versions 3.0.0 through 4.0.2

Description The issue is related to an unsafe validation RegEx in the EmailField component, which allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

Recommendations For versions 2.0.4 through 2.3.2, update to a version outside of this range to resolve the issue. For versions 3.0.0 through 4.0.2, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting the input to the EmailField component to prevent malicious email addresses from being submitted.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-31405

GHSA-2WQP-JMCC-MC77

GHSA-CRH4-294P-VCFQ

Affected Products

Vaadin-Text-Field-Flow

References · 9

• https://github.com/vaadin/flow-components/pull/442 · Patch
• https://osv.dev/vulnerability/GHSA-2wqp-jmcc-mc77 · Vendor Advisory
• https://vaadin.com/security/cve-2021-31405 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31405 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31405 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-crh4-294p-vcfq · Vendor Advisory
• https://github.com/vaadin/platform/security/advisories/GHSA-2wqp-jmcc-mc77 · Note
• https://github.com/vaadin/flow-components · Note
• https://github.com/vaadin/flow-components/security/advisories/GHSA-crh4-294p-vcfq · Note