CVE-2021-31408 : Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.

Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.

Published 2021-04-23 17:15:08

Updated 2021-05-04 16:19:44

Source Vaadin Ltd.

View at NVD, CVE.org

Vulnerability category: Cross-site request forgery (CSRF)

Exploit prediction scoring system (EPSS) score for CVE-2021-31408

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 26 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-31408

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.3	LOW	AV:L/AC:M/Au:N/C:P/I:P/A:N	3.4	4.9	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
7.1	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N	1.8	5.2	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: None
6.3	MEDIUM	CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N	1.0	5.2	Vaadin Ltd.
Attack Vector: Local Attack Complexity: High Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2021-31408

CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Assigned by:

nvd@nist.gov (Primary)
security@vaadin.com (Secondary)

References for CVE-2021-31408

https://github.com/vaadin/flow/pull/10577

fix: store spring csrf to bootstrap page by haijian-vaadin · Pull Request #10577 · vaadin/flow · GitHub
Patch;Third Party Advisory
https://vaadin.com/security/cve-2021-31408

CVE-2021-31408: Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
Vendor Advisory

Products affected by CVE-2021-31408

Vaadin » Vaadin
Versions from including (>=) 19.0.0 and before (<) 19.0.4
cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*
Matching versions
Vaadin » Vaadin » Version: 18.0.0
cpe:2.3:a:vaadin:vaadin:18.0.0:-:*:*:*:*:*:*
Matching versions
Vaadin » Flow
Versions from including (>=) 5.0.0 and before (<) 6.0.0
cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*
Matching versions
Vaadin » Flow
Versions from including (>=) 6.0.0 and before (<) 6.0.5
cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2021-31408

Exploit prediction scoring system (EPSS) score for CVE-2021-31408

CVSS scores for CVE-2021-31408

CWE ids for CVE-2021-31408

References for CVE-2021-31408

Products affected by CVE-2021-31408