Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/com.vaadin/flow-server@2.3.1
Typemaven
Namespacecom.vaadin
Nameflow-server
Version2.3.1
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version2.4.8
Latest_non_vulnerable_version25.0.2
Affected_by_vulnerabilities
0
url VCID-5nk4-urbw-suee
vulnerability_id VCID-5nk4-urbw-suee
summary 
Path Traversal
Improper URL validation in development mode handler in `com.vaadin:flow-server` allows attacker to request arbitrary files stored outside of intended frontend resources folder.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-36321
reference_id
reference_type
scores
0
value 0.00551
scoring_system epss
scoring_elements 0.68345
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-36321
1
reference_url https://github.com/vaadin/flow/pull/9392
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vaadin/flow/pull/9392
2
reference_url https://github.com/vaadin/flow/security/advisories/GHSA-49r2-73m6-pp8f
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vaadin/flow/security/advisories/GHSA-49r2-73m6-pp8f
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-36321
reference_id CVE-2020-36321
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-36321
4
reference_url https://vaadin.com/security/cve-2020-36321
reference_id CVE-2020-36321
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://vaadin.com/security/cve-2020-36321
fixed_packages
0
url pkg:maven/com.vaadin/flow-server@2.4.2
purl pkg:maven/com.vaadin/flow-server@2.4.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-hqrf-7nbq-9bdw
1
vulnerability VCID-yu3h-ecpv-qyhu
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.vaadin/flow-server@2.4.2
1
url pkg:maven/com.vaadin/flow-server@4.0.1
purl pkg:maven/com.vaadin/flow-server@4.0.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2fz6-rucr-xqax
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.vaadin/flow-server@4.0.1
2
url pkg:maven/com.vaadin/flow-server@5.0.0
purl pkg:maven/com.vaadin/flow-server@5.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2fz6-rucr-xqax
1
vulnerability VCID-hqrf-7nbq-9bdw
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.vaadin/flow-server@5.0.0
aliases CVE-2020-36321, GHSA-49r2-73m6-pp8f
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5nk4-urbw-suee
1
url VCID-hqrf-7nbq-9bdw
vulnerability_id VCID-hqrf-7nbq-9bdw
summary 
Information Exposure Through Discrepancy
A non-constant-time comparison of CSRF tokens in UIDL request handler in `com.vaadin:flow-server` allows attacker to guess a security token via timing attack.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-31404
reference_id
reference_type
scores
0
value 0.00045
scoring_system epss
scoring_elements 0.14389
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-31404
1
reference_url https://github.com/vaadin/flow/pull/9875
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vaadin/flow/pull/9875
2
reference_url https://github.com/vaadin/flow/security/advisories/GHSA-xwg3-qrcg-w9x6
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/vaadin/flow/security/advisories/GHSA-xwg3-qrcg-w9x6
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-31404
reference_id CVE-2021-31404
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-31404
4
reference_url https://vaadin.com/security/cve-2021-31404
reference_id CVE-2021-31404
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://vaadin.com/security/cve-2021-31404
fixed_packages
0
url pkg:maven/com.vaadin/flow-server@2.4.7
purl pkg:maven/com.vaadin/flow-server@2.4.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-yu3h-ecpv-qyhu
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.vaadin/flow-server@2.4.7
1
url pkg:maven/com.vaadin/flow-server@4.0.1
purl pkg:maven/com.vaadin/flow-server@4.0.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2fz6-rucr-xqax
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.vaadin/flow-server@4.0.1
2
url pkg:maven/com.vaadin/flow-server@5.0.3
purl pkg:maven/com.vaadin/flow-server@5.0.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2fz6-rucr-xqax
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.vaadin/flow-server@5.0.3
aliases CVE-2021-31404, GHSA-xwg3-qrcg-w9x6
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-hqrf-7nbq-9bdw
2
url VCID-yu3h-ecpv-qyhu
vulnerability_id VCID-yu3h-ecpv-qyhu
summary 
Exposure of Resource to Wrong Sphere
A vulnerability in the OSGi integration in `com.vaadin:flow-server` allows attackers to access application classes and resources on the server via crafted HTTP request.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-31407
reference_id
reference_type
scores
0
value 0.01802
scoring_system epss
scoring_elements 0.83139
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-31407
1
reference_url https://github.com/vaadin/flow
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vaadin/flow
2
reference_url https://github.com/vaadin/flow/pull/10229
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vaadin/flow/pull/10229
3
reference_url https://github.com/vaadin/flow/pull/10269
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vaadin/flow/pull/10269
4
reference_url https://github.com/vaadin/flow/security/advisories/GHSA-25xc-jwfq-39jw
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vaadin/flow/security/advisories/GHSA-25xc-jwfq-39jw
5
reference_url https://github.com/vaadin/osgi/issues/50
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/vaadin/osgi/issues/50
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-31407
reference_id CVE-2021-31407
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-31407
7
reference_url https://vaadin.com/security/cve-2021-31407
reference_id CVE-2021-31407
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://vaadin.com/security/cve-2021-31407
fixed_packages
0
url pkg:maven/com.vaadin/flow-server@2.4.8
purl pkg:maven/com.vaadin/flow-server@2.4.8
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.vaadin/flow-server@2.4.8
1
url pkg:maven/com.vaadin/flow-server@6.0.1
purl pkg:maven/com.vaadin/flow-server@6.0.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-yu3h-ecpv-qyhu
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.vaadin/flow-server@6.0.1
2
url pkg:maven/com.vaadin/flow-server@6.0.2
purl pkg:maven/com.vaadin/flow-server@6.0.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.vaadin/flow-server@6.0.2
aliases CVE-2021-31407, GHSA-25xc-jwfq-39jw
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-yu3h-ecpv-qyhu
Fixing_vulnerabilities
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/com.vaadin/flow-server@2.3.1