cve.bz

CVE-2021-31403

2.5 lowEPSS 0.3%

Low (2.5) in vaadin vaadin. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in com.vaadin:vaadin-bom 7.7.24, 8.12.3.

Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security token via timing attack

Severity

CVSS 3.1

2.5 low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWEs
CWE-203, CWE-208
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-75xc-qvxh-27f8Mavencom.vaadin:vaadin-bom>=7.0.0 <7.7.247.7.24
GHSA-75xc-qvxh-27f8Mavencom.vaadin:vaadin-bom>=8.0.0 <8.12.38.12.3
GHSA-75xc-qvxh-27f8Mavencom.vaadin:vaadin-server>=7.0.0 <7.7.247.7.24
GHSA-75xc-qvxh-27f8Mavencom.vaadin:vaadin-server>=8.0.0 <8.12.38.12.3

References

Check your stackJSON