CVE-2021-31409

Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19

CVSS 7.5 HIGHEPSS 1.7%CWE-400

Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Productos afectados

Vaadin · Vaadin Vaadin · vaadin-compatibility-server

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://github.com/vaadin/framework/issues/12240 https://github.com/vaadin/framework/pull/12241 https://vaadin.com/security/cve-2021-31409