CVE-2021-31412mediumCWE-1295

CVE-2021-31412: medium-severity vulnerability in Vaadin

Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19

Published · Updated

Follow this CVE+ Monitor Vaadin+ Monitor flow-server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 1.3%
In short

A Vaadin web framework flaw allows attackers to discover all available routes (URLs) in a production application by sending specially crafted requests, if no custom error handler is set up. This can help attackers map out the application's structure and find vulnerable endpoints.

Technical detail

The default RouteNotFoundError view in Vaadin flow-server fails to properly sanitize the request path, enabling route enumeration attacks in production mode when no custom NotFoundException handler is configured. An unauthenticated network attacker can discover all available application routes by probing for 404 responses, facilitating reconnaissance for further exploitation.

Summary generated and translated by AI from the official description.
Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for NotFoundException is provided.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Vaadin · flow-serverVaadin · Vaadin
Related CVEs — Vaadin

In the same product, most dangerous first.

CVE-2021-31407HIGHServer classes and resources exposure in OSGi applications using Vaadin 12-14 and 19EPSS 2.4%CVE-2020-36320HIGHRegular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7EPSS 2.0%CVE-2021-31409HIGHServer session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19EPSS 1.7%CVE-2020-36321MEDIUMDirectory traversal in development mode handler in Vaadin 14 and 15-17EPSS 1.2%CVE-2021-31405HIGHRegular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17EPSS 1.1%CVE-2020-36319LOWPotential sensitive data exposure in applications using Vaadin 15EPSS 1.0%