CVE-2021-31403

—

CVSS 3.1

2.5 low

EPSS

<1%p23

Published

Apr 23, 2021 (Apr 23, 2021)

Modified

Jun 17, 2026

Description

Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security token via timing attack

Vendors: vaadin
Products: vaadin
Weakness: CWE-208, CWE-203
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.