CVE-2021-31404

Name of the Vulnerable Software and Affected Versions com.vaadin:flow-server versions 1.0.0 through 1.0.13 com.vaadin:flow-server versions 1.1.0 prior to 2.0.0 com.vaadin:flow-server versions 2.0.0 through 2.4.6 com.vaadin:flow-server versions 3.0.0 prior to 5.0.0 com.vaadin:flow-server versions 5.0.0 through 5.0.2

Description The issue is related to a non-constant-time comparison of CSRF tokens in the UIDL request handler, which allows an attacker to guess a security token via a timing attack.

Recommendations For com.vaadin:flow-server versions 1.0.0 through 1.0.13, update to a version outside of this range. For com.vaadin:flow-server versions 1.1.0 prior to 2.0.0, update to version 2.0.0 or later. For com.vaadin:flow-server versions 2.0.0 through 2.4.6, update to a version outside of this range. For com.vaadin:flow-server versions 3.0.0 prior to 5.0.0, update to version 5.0.0 or later. For com.vaadin:flow-server versions 5.0.0 through 5.0.2, update to a version outside of this range.