CVE-2021-31403

LowCVSS 2.5/10Last modified Jun 17, 2026

Description

Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security token via timing attack

Metrics

CVSS 3.1 2.5/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-208 CWE-203

Affected software

Vendor	Product	Versions
Vaadin	Vaadin	>= 7.0.0, < *
Vaadin	vaadin-server	>= 7.0.0, < *

References

https://github.com/vaadin/framework/pull/12188Patch, Third Party Advisory
https://github.com/vaadin/framework/pull/12190Patch, Third Party Advisory
https://vaadin.com/security/cve-2021-31403Vendor Advisory
https://github.com/vaadin/framework/pull/12188Patch, Third Party Advisory
https://github.com/vaadin/framework/pull/12190Patch, Third Party Advisory
https://vaadin.com/security/cve-2021-31403Vendor Advisory

Timeline

Published: Apr 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-314042.5Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 t CVE-2021-314057.5Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.CVE-2021-314062.5Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.CVE-2021-314077.5Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6 CVE-2021-314087.1Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 t CVE-2021-314097.5Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions CVE-2021-31417.8In Unisys Stealth (core) before 6.0.025.0, the Keycloak password is stored in a recoverable format that might be accessible by a local attac CVE-2021-314107.5Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access CVE-2021-314117.8Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 thr CVE-2021-314125.3Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 thro CVE-2021-314149.8The unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code execution via a crafted workspace configurat CVE-2021-314176.5This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An