CVE-2021-31407: Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19
Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-31407?
CVE-2021-31407 is classified as a high-severity vulnerability allowing unauthorized access to application classes and resources.
How do I fix CVE-2021-31407?
To mitigate CVE-2021-31407, upgrade Vaadin Flow to version 2.4.8 or later, or to version 6.0.2 or later.
Which versions of Vaadin are affected by CVE-2021-31407?
CVE-2021-31407 affects Vaadin Flow versions 1.2.0 through 2.4.7 and 6.0.0 through 6.0.1 as well as Vaadin versions 12.0.0 through 14.4.9 and 19.0.0.
What type of attacks are possible due to CVE-2021-31407?
CVE-2021-31407 allows attackers to access sensitive application classes and resources on the server through crafted HTTP requests.
Is there a proof of concept for CVE-2021-31407?
Yes, there are discussions and pull requests related to CVE-2021-31407 on GitHub which imply the existence of proof of concepts.