CVE-2021-31407 HIGH

CVE-2021-31407: Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19

Vendor Vaadin
Product Vaadin
Weakness CWE-402
Published April 23, 2021
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.

Key dates

02Disclosure timeline

April 23, 2021 CVE published
September 16, 2024 Record updated