CVE-2021-31403

    Dashboard / Vulnerabilities / CVE-2021-31403

    CVE-2021-31403

    Published: 23 Apr 2021Last Modified: 15 Jul 2026

    Summary:

    Details: Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security token via timing attack

    References: https://vaadin.com/security/cve-2021-31403, https://github.com/vaadin/framework/pull/12188, https://github.com/vaadin/framework/pull/12190

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- b29ce01468ed115e942105986da362d665408033
    Fixed -ebfc693f2d74965aebc6773ee696153441a822e5

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-31403 | CVE-DB