Read the docs
TI-2021-11539 Aliases CVE-2021-31407GHSA-25xc-jwfq-39jw

Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19

Priority MEDIUM 42CWE-402Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-668 and the CVSS impact.

Summary

Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.

Why it matters now

EPSS 0.02382 83rd percentileScored 2026-11-07
Fix Fixed com.vaadin:flow-server (Maven): 2.4.8, 6.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
VaadinVaadin19.0.0; 12.0.0 and later—No fix listedCNA
Vaadinflow-server1.2.0 and later—No fix listedCNA
—com.vaadin:flow-server (Maven)1.2.0 to before 2.4.82.4.8Patch availableGHSA-25xc-jwfq-39jw
—com.vaadin:flow-server (Maven)6.0.0 to before 6.0.16.0.1Patch availableGHSA-25xc-jwfq-39jw
  • Vaadin VendorVaadin Affected 19.0.0; 12.0.0 and later Fixed in — No fix listed CNA
  • flow-server VendorVaadin Affected 1.2.0 and later Fixed in — No fix listed CNA
  • com.vaadin:flow-server (Maven) Vendor— Affected 1.2.0 to before 2.4.8 Fixed in 2.4.8 Patch available GHSA-25xc-jwfq-39jw
  • com.vaadin:flow-server (Maven) Vendor— Affected 6.0.0 to before 6.0.1 Fixed in 6.0.1 Patch available GHSA-25xc-jwfq-39jw

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*1.2.0 to before 2.4.8; 6.0.0 to before 6.0.2VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*12.0.0 to before 14.4.10VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:19.0.0:-:*:*:*:*:*:*19.0.0VulnerableVaadin
  • cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:* Versions 1.2.0 to before 2.4.8; 6.0.0 to before 6.0.2 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 12.0.0 to before 14.4.10 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:19.0.0:-:*:*:*:*:*:* Versions 19.0.0 Vulnerable ·Vaadin

Remediation

  • Fix · GHSA-25xc-jwfq-39jw com.vaadin:flow-server (Maven) Fixed in 2.4.8 Advisory →
  • Fix · GHSA-25xc-jwfq-39jw com.vaadin:flow-server (Maven) Fixed in 6.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-31407
  2. 2026-10-03 Alias added: GHSA-25xc-jwfq-39jw

References

Patch 3

Advisory 2

Other 2

  • TI-2021-11537 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
  • TI-2020-18604 Directory traversal in development mode handler in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
  • TI-2021-11543 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 CVSS 3.1HIGH 7.8
  • TI-2021-11540 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVSS 3.1HIGH 7.1
  • TI-2020-18602 Potential sensitive data exposure in applications using Vaadin 15 CVSS 3.1MEDIUM 6.5
  • TI-2019-15167 Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 CVSS 3.1MEDIUM 6.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences