CVE-2021-31407

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-402 CWE-668

Affected software

Vendor	Product	Versions
Vaadin	Vaadin	19.0.0; >= 12.0.0, < *
Vaadin	flow-server	>= 1.2.0, < *

References

https://github.com/vaadin/flow/pull/10229Patch, Third Party Advisory
https://github.com/vaadin/flow/pull/10269Patch, Third Party Advisory
https://github.com/vaadin/osgi/issues/50Patch, Third Party Advisory
https://vaadin.com/security/cve-2021-31407Vendor Advisory
https://github.com/vaadin/flow/pull/10229Patch, Third Party Advisory
https://github.com/vaadin/flow/pull/10269Patch, Third Party Advisory
https://github.com/vaadin/osgi/issues/50Patch, Third Party Advisory
https://vaadin.com/security/cve-2021-31407Vendor Advisory

Timeline

Published: Apr 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-314087.1Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 t CVE-2021-314097.5Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions CVE-2021-31417.8In Unisys Stealth (core) before 6.0.025.0, the Keycloak password is stored in a recoverable format that might be accessible by a local attac CVE-2021-314107.5Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access CVE-2021-314117.8Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 thr CVE-2021-314125.3Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 thro CVE-2021-314149.8The unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code execution via a crafted workspace configurat CVE-2021-314176.5This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An CVE-2021-314186.5This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An CVE-2021-314196.5This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An CVE-2021-314208.8This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.0-48950. An attacker mu CVE-2021-314216.0This vulnerability allows local attackers to delete arbitrary files on affected installations of Parallels Desktop 16.1.1-49141. An attacker