CVE-2021-31408 MEDIUM

CVE-2021-31408: Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19

Vendor Vaadin
Product Vaadin
Weakness CWE-613 · Insufficient session expiration
Published April 23, 2021
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Local
Attack complexity High
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.

Key dates

02Disclosure timeline

April 23, 2021 CVE published
September 17, 2024 Record updated