CVE-2021-31408: Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-31408?
CVE-2021-31408 has been rated as a medium severity vulnerability due to the potential for local attackers to exploit it.
How do I fix CVE-2021-31408?
To mitigate CVE-2021-31408, upgrade to Vaadin Flow versions 6.0.0 or later, or ensure you are using Vaadin Vaadin 19.0.4 or later.
What versions are affected by CVE-2021-31408?
CVE-2021-31408 affects Vaadin Flow versions 5.0.0 to 6.0.0 and versions 6.0.0 through 6.0.4, along with Vaadin Vaadin versions 19.0.0 through 19.0.3 and 18.0.0.
What is the impact of CVE-2021-31408?
The impact of CVE-2021-31408 can allow local attackers to bypass Spring Security CSRF protection and access unauthorized resources.
Is there a workaround for CVE-2021-31408?
While upgrading is the recommended solution, implementing additional security measures such as reviewing access permissions may serve as a temporary workaround for CVE-2021-31408.