Riskcovery

CVE-2021-31412

Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19

State
Published
Severity
5.3 Medium
Published
Jun 24, 2021
Updated
Sep 16, 2024
Reserved
Apr 15, 2021

Read the record on cve.org

Description

Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for NotFoundException is provided.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NVaadin

Weaknesses

  • CWE-1295 Debug Messages Revealing Unnecessary Information

Affected Products

ProductVersions
VaadinVaadin
  • 10.0.0 to before unspecifiedAffected
  • 10.0.18 and earlierAffected
  • 11.0.0 to before unspecifiedAffected
  • before 14.0.0Affected
  • 14.0.0 to before unspecifiedAffected
  • 14.6.1 and earlierAffected
  • 15.0.0 to before unspecifiedAffected
  • 19.0.8 and earlierAffected
flow-serverVaadin
  • 1.0.0 to before unspecifiedAffected
  • 1.0.14 and earlierAffected
  • 1.1.0 to before unspecifiedAffected
  • before 2.0.0Affected
  • 2.0.0 to before unspecifiedAffected
  • 2.6.1 and earlierAffected
  • 3.0.0 to before unspecifiedAffected
  • 6.0.9 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.