Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

CVE-2021-31408

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-mr8h-j9cv-4m8h

Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 `Authentication.logout()` helper in `com.vaadin:flow-client` versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out. - https://vaadin.com/security/cve-2021-31408

gitlab/maven/com.vaadin/flow-client/CVE-2021-31408

Insufficient Session Expiration `Authentication.logout()` helper in `com.vaadin:flow-client` uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.

gitlab/maven/com.vaadin/flow/CVE-2021-31408

Insufficient Session Expiration `Authentication.logout()` uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.

gitlab/maven/com.vaadin/vaadin-bom/CVE-2021-31408

Insufficient Session Expiration Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.

gitlab/maven/com.vaadin/vaadin-server/CVE-2021-31408

Insufficient Session Expiration The `Authentication.logout()` helper in `com.vaadin:flow-client` uses an incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.