CVE-2021-31406: Timing side channel vulnerability in endpoint request handler in Vaadin 15-19
Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-31406?
CVE-2021-31406 has a moderate severity rating due to its potential for CSRF token guessing.
How do I fix CVE-2021-31406?
To fix CVE-2021-31406, update your Vaadin dependencies to a version above 5.0.3 or 6.0.0.
What versions are affected by CVE-2021-31406?
CVE-2021-31406 affects Vaadin Flow versions 3.0.0 through 5.0.3 and Vaadin 15.0.0 through 18.0.6.
Can CVE-2021-31406 be exploited remotely?
Yes, CVE-2021-31406 can be exploited remotely by an attacker to guess CSRF tokens.
What is the primary vulnerability in CVE-2021-31406?
CVE-2021-31406 involves non-constant-time comparison of CSRF tokens in the request handler.