com.vaadin:flow-server における観測可能な不一致に関する脆弱性
| Title |
com.vaadin:flow-server における観測可能な不一致に関する脆弱性
|
| Summary |
com.vaadin:flow-server には、観測可能な不一致に関する脆弱性が存在します。
|
| Possible impacts |
情報を取得される可能性があります。 |
| Solution |
ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date |
Jan. 26, 2021, midnight |
| Registration Date |
Dec. 27, 2021, 4:56 p.m. |
| Last Update |
Dec. 27, 2021, 4:56 p.m. |
|
CVSS3.0 : 低
|
| Score |
2.5
|
| Vector |
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
|
CVSS2.0 : 注意
|
| Score |
1.9
|
| Vector |
AV:L/AC:M/Au:N/C:P/I:N/A:N |
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2021年12月27日]
掲載 |
Dec. 27, 2021, 4:56 p.m. |
NVD Vulnerability Information
CVE-2021-31404
| Summary |
Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaadin 15 prior to 18), and 5.0.0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack.
|
| Publication Date |
April 24, 2021, 1:15 a.m. |
| Registration Date |
April 24, 2021, 10:05 a.m. |
| Last Update |
Nov. 21, 2024, 3:05 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:* |
1.1.0 |
|
|
2.0.0 |
| cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:* |
3.0.0 |
|
|
5.0.0 |
| cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* |
11.0.0 |
|
|
14.0.0 |
| cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* |
15.0.0 |
|
|
17.0.0 |
| cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:* |
1.0.0 |
|
|
1.0.14 |
| cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:* |
2.0.0 |
|
|
2.4.7 |
| cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:* |
5.0.0 |
|
|
5.0.3 |
| cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* |
10.0.0 |
|
|
10.0.17 |
| cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* |
14.0.0 |
|
|
14.4.7 |
| cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* |
18.0.0 |
|
|
18.0.6 |
Related information, measures and tools
Common Vulnerabilities List