GHSA-9h6g-6mxg-vvp4
Timing side channel vulnerability in endpoint request handler in Vaadin 15-19
GHSA-9h6g-6mxg-vvp4 is a medium vulnerability (CVSS 4.0) in com.vaadin:vaadin-bom, published April 19, 2021. No source lists public exploit code. Fixed in com.vaadin:vaadin-bom 19.0.1.
- Severity
- 4.0 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
19.0.1com.vaadin:vaadin-bom +3 more
Description
Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.vaadin:vaadin-bomMaven | 19.0.0 to 19.0.0 | 19.0.1 |
com.vaadin:vaadin-bomMaven | 15.0.0 up to 18.0.7 | 18.0.7 |
com.vaadin:vaadin-bomMaven | 19.0.0 up to 19.0.1 | 19.0.1 |
com.vaadin:vaadin-bomMaven | 15.0.0 up to 18.0.7, plus listed versions 15.0.115.0.215.0.315.0.415.0.5 Show 25 moreShow less15.0.616.0.016.0.116.0.216.0.316.0.416.0.517.0.017.0.117.0.1017.0.1117.0.217.0.317.0.417.0.617.0.717.0.817.0.918.0.018.0.118.0.218.0.318.0.418.0.518.0.6 | 18.0.7 |
What each source reports
GitHub Advisories Score used
Timing side channel vulnerability in endpoint request handler in Vaadin 15-19
Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.
- Record
GHSA-9h6g-6mxg-vvp4- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-208
- Updated
- 2026-11-02
OSV
Timing side channel vulnerability in endpoint request handler in Vaadin 15-19
Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.
- Record
GHSA-9h6g-6mxg-vvp4- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-208
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.