TI-2021-11535 Aliases CVE-2021-31403 GHSA-75xc-qvxh-27f8

Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8

LOW 19CWE-208Published 2021-04-23 · Updated 2024-09-16

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-208.

Summary

Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security token via timing attack

Why it matters now

EPSS 0.00306 23rd percentileScored 2026-11-07

Fix Fixed com.vaadin:vaadin-bom (Maven): 7.7.24, 8.12.3com.vaadin:vaadin-server (Maven): 7.7.24, 8.12.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Vaadin	Vaadin	7.0.0 and later	—	No fix listed	CNA
Vaadin	vaadin-server	7.0.0 and later	—	No fix listed	CNA
—	com.vaadin:vaadin-bom (Maven)	7.0.0 to before 7.7.24	7.7.24	Patch available	GHSA-75xc-qvxh-27f8
—	com.vaadin:vaadin-bom (Maven)	8.0.0 to before 8.12.3	8.12.3	Patch available	GHSA-75xc-qvxh-27f8
—	com.vaadin:vaadin-server (Maven)	7.0.0 to before 7.7.24	7.7.24	Patch available	GHSA-75xc-qvxh-27f8
—	com.vaadin:vaadin-server (Maven)	8.0.0 to before 8.12.3	8.12.3	Patch available	GHSA-75xc-qvxh-27f8

Vaadin VendorVaadin Affected 7.0.0 and later Fixed in — No fix listed CNA
vaadin-server VendorVaadin Affected 7.0.0 and later Fixed in — No fix listed CNA
com.vaadin:vaadin-bom (Maven) Vendor— Affected 7.0.0 to before 7.7.24 Fixed in 7.7.24 Patch available GHSA-75xc-qvxh-27f8
com.vaadin:vaadin-bom (Maven) Vendor— Affected 8.0.0 to before 8.12.3 Fixed in 8.12.3 Patch available GHSA-75xc-qvxh-27f8
com.vaadin:vaadin-server (Maven) Vendor— Affected 7.0.0 to before 7.7.24 Fixed in 7.7.24 Patch available GHSA-75xc-qvxh-27f8
com.vaadin:vaadin-server (Maven) Vendor— Affected 8.0.0 to before 8.12.3 Fixed in 8.12.3 Patch available GHSA-75xc-qvxh-27f8

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vaadin:vaadin::::::::	7.0.0 to before 7.7.24; 8.0.0 to before 8.12.3	Vulnerable	Vaadin

cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 7.0.0 to before 7.7.24; 8.0.0 to before 8.12.3 Vulnerable ·Vaadin

Remediation

Fix · GHSA-75xc-qvxh-27f8 com.vaadin:vaadin-bom (Maven) Fixed in 7.7.24 Advisory →
Fix · GHSA-75xc-qvxh-27f8 com.vaadin:vaadin-bom (Maven) Fixed in 8.12.3 Advisory →
Fix · GHSA-75xc-qvxh-27f8 com.vaadin:vaadin-server (Maven) Fixed in 7.7.24 Advisory →
Fix · GHSA-75xc-qvxh-27f8 com.vaadin:vaadin-server (Maven) Fixed in 8.12.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-31403
2026-10-03 Alias added: GHSA-75xc-qvxh-27f8

References

Patch 2

Advisory 2

Other 1

https://github.com/vaadin/framework/security/advisories/GHSA-75xc-qvxh-27f8

TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
TI-2020-18603 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 CVSS 3.1HIGH 7.5
TI-2021-11541 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVSS 3.1HIGH 7.5
TI-2022-12014 Possible information disclosure inside TreeGrid component with default data provider CVSS 3.1HIGH 7.5
TI-2021-11537 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
TI-2020-18604 Directory traversal in development mode handler in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences