CVE-2021-31411

Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19

State: Published
Severity: 6.3 Medium
Published: May 5, 2021
Updated: Sep 16, 2024
Reserved: Apr 15, 2021

Description

Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to inject malicious code into frontend resources during application rebuilds.

Scores

CVSS	Score	Vector	Source
3.1	6.3 Medium	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N	Vaadin

Weaknesses

CWE-379 Creation of Temporary File in Directory with Incorrect Permissions

Affected Products

Product	Versions
VaadinVaadin	14.0.3 and laterAffectedfrom 15.0.0Affectedfrom 19.0.0Not affectedfrom 19.0.0Affected
flow-serverVaadin	2.0.9 and laterAffectedfrom 3.0.0Affectedfrom 6.0.0Not affectedfrom 6.0.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.