Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19

높음 7.1CVE-2021-31408 · GHSA-mr8h-j9cv-4m8h · Published 23/04/2021 · updated 17/06/2026

요약

CVE-2021-31408은(는) com.vaadin:vaadin-bom, flow (vaadin), vaadin (vaadin)에 영향을 주는 높음 (CVSS 7.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.32%, 전체 취약점의 25.2%보다 높음.
조치: 19.0.4, 6.0.0, 6.0.5 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
com.vaadin:vaadin-bom Maven	`≥ 18.0.0, < 19.0.4`	`19.0.4`
flow vaadin	`≥ 5.0.0, < 6.0.0≥ 6.0.0, < 6.0.5`	`6.0.06.0.5`
vaadin vaadin	`= 18.0.0≥ 19.0.0, < 19.0.4`	`19.0.4`

Description

Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.

https://vaadin.com/security/cve-2021-31408

NVD description

Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.

References

vaadin/platform security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-31408 · ADVISORY
vaadin/flow#10577 · WEB
vaadin.com/security/cve-2021-31408 · WEB

com.vaadin:vaadin-bom의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.vaadin:vaadin-bom

Maven

≥ 18.0.0, < 19.0.4

19.0.4

flow

vaadin

≥ 5.0.0, < 6.0.0≥ 6.0.0, < 6.0.5

6.0.06.0.5

vaadin

= 18.0.0≥ 19.0.0, < 19.0.4

19.0.4

Description

https://vaadin.com/security/cve-2021-31408

NVD description

com.vaadin:vaadin-bom의 다른 취약점

모두 보기 →