CVE-2021-31405: falha de alta gravidade em Vaadin
Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 1.1%
Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVEs relacionadas — Vaadin
No mesmo produto, das mais perigosas para as menos.
CVE-2021-31407HIGHServer classes and resources exposure in OSGi applications using Vaadin 12-14 and 19EPSS 2.4%CVE-2020-36320HIGHRegular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7EPSS 2.0%CVE-2021-31409HIGHServer session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19EPSS 1.7%CVE-2021-31412MEDIUMPossible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19EPSS 1.3%CVE-2020-36321MEDIUMDirectory traversal in development mode handler in Vaadin 14 and 15-17EPSS 1.2%CVE-2020-36319LOWPotential sensitive data exposure in applications using Vaadin 15EPSS 1.0%