CVE-2021-31408

Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19

State: Published
Severity: 6.3 Medium
Published: Apr 23, 2021
Updated: Sep 17, 2024
Reserved: Apr 15, 2021

Description

Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.

Scores

CVSS	Score	Vector	Source
3.1	6.3 Medium	CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N	Vaadin

Weaknesses

CWE-613 Insufficient Session Expiration

Affected Products

Product	Versions
VaadinVaadin	18.0.0 and laterAffectedfrom 19.0.0Not affectedfrom 19.0.0Affected
flow-clientVaadin	5.0.0 and laterAffectedfrom 6.0.0Not affectedfrom 6.0.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.