CVE-2021-31403

Name of the Vulnerable Software and Affected Versions com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 com.vaadin:vaadin-server versions 8.0.0 through 8.12.2

Description The issue is related to a non-constant-time comparison of CSRF tokens in the UIDL request handler. This allows an attacker to guess a security token via a timing attack.

Recommendations For versions 7.0.0 through 7.7.23, update to a version outside of this range to mitigate the risk. For versions 8.0.0 through 8.12.2, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider implementing constant-time comparison for CSRF tokens in the UIDL request handler until a patch is available.