{"id":"GHSA-9h6g-6mxg-vvp4","aliases":[],"status":"published","title":"Timing side channel vulnerability in endpoint request handler in Vaadin 15-19","description":"Non-constant-time comparison of CSRF tokens in endpoint request handler in `com.vaadin:flow-server` versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.\n\n- https://vaadin.com/security/cve-2021-31406","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-208"],"published":"2021-04-19T14:47:18Z","modified":"2024-12-02T05:45:00Z","fixes":[{"ecosystem":"Maven","package":"com.vaadin:vaadin-bom","fixed_in":["19.0.1","18.0.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.vaadin:vaadin-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.0.0"},{"last_affected":"19.0.0"},{"fixed":"19.0.1"}]}],"versions":["19.0.0"]},{"source":"ghsa","ecosystem":"Maven","package":"com.vaadin:vaadin-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0"},{"fixed":"18.0.7"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.vaadin:vaadin-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.0.0"},{"fixed":"19.0.1"}]}],"versions":["19.0.0"]},{"source":"osv","ecosystem":"Maven","package":"com.vaadin:vaadin-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0"},{"fixed":"18.0.7"}]}],"versions":["15.0.0","15.0.1","15.0.2","15.0.3","15.0.4","15.0.5","15.0.6","16.0.0","16.0.1","16.0.2","16.0.3","16.0.4","16.0.5","17.0.0","17.0.1","17.0.10","17.0.11","17.0.2","17.0.3","17.0.4","17.0.6","17.0.7","17.0.8","17.0.9","18.0.0","18.0.1","18.0.2","18.0.3","18.0.4","18.0.5","18.0.6"]}],"references":[{"url":"https://github.com/vaadin/platform/security/advisories/GHSA-9h6g-6mxg-vvp4","tags":["web"]},{"url":"https://vaadin.com/security/cve-2021-31406","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9h6g-6mxg-vvp4"},{"url":"https://github.com/vaadin/platform","tags":["web"]}],"sources":{"ghsa":[{"id":"GHSA-9h6g-6mxg-vvp4","title":"Timing side channel vulnerability in endpoint request handler in Vaadin 15-19","description":"Non-constant-time comparison of CSRF tokens in endpoint request handler in `com.vaadin:flow-server` versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.\n\n- https://vaadin.com/security/cve-2021-31406","status":"published","published":"2021-04-19T14:47:18Z","modified":"2023-01-09T05:04:55Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:36:10.502376Z"}],"osv":[{"id":"GHSA-9h6g-6mxg-vvp4","title":"Timing side channel vulnerability in endpoint request handler in Vaadin 15-19","description":"Non-constant-time comparison of CSRF tokens in endpoint request handler in `com.vaadin:flow-server` versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.\n\n- https://vaadin.com/security/cve-2021-31406","status":"published","published":"2021-04-19T14:47:18Z","modified":"2024-12-02T05:45:00.685897Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:46:43.875515Z"}]}}