CVE-2021-31408
- Source
- https://cve.org/CVERecord?id=CVE-2021-31408
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-31408.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-31408
- Aliases
- Published
- 2021-04-23T17:15:08.260Z
- Modified
- 2026-08-07T16:57:20.968667Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.
- References
Affected packages
Git / github.com/vaadin/flow
Database specific
vanir_signatures
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1251.0,
"function_hash": "95895721501235828134604377938523968589"
},
"id": "CVE-2021-31408-0f722b11",
"target": {
"function": "collectChanges",
"file": "flow-server/src/main/java/com/vaadin/flow/internal/nodefeature/NodeList.java"
},
"source": "https://github.com/vaadin/flow/commit/6a409a8b4b01b18dc2ca30c59395aeeb0cffbd2c",
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"301385501104286487236082474253944597235",
"33209595235755426172916430696119825081",
"20130507728000689394003554922185758202",
"27648121960375167056664220454613286655",
"333238594463227270340145318059775157759",
"162426196315294167714190241247049851805",
"143108685391574631857168530404470296537",
"289525921492748990051647339521813580169",
"196691798456890731011850001610931258878",
"94015583440665660485056429945279570936",
"233631714151873210613941553197754484653",
"339847406786329252231261177293433668469",
"158451126977230762946940923398983625055",
"158561942680941256530785398242166653410",
"304251129949362873653769766125841361873",
"308380952411650632855764156023128986748",
"239397498041292766278781133946454103885",
"237104372402625998198687946668778901177",
"106995218599822985345613317210655828759",
"292843368295729651396147701559040228668",
"340030634345836298512821769515880812703",
"41399387311399976888416394535194411084",
"331740420109745386061601803818086353335",
"8884998506346186952570742046383395492",
"139933011338285433419770049601160816830",
"98720156670210664928699433727468960320"
],
"threshold": 0.9
},
"id": "CVE-2021-31408-3cbf096d",
"target": {
"file": "flow-server/src/test/java/com/vaadin/flow/server/communication/IndexHtmlRequestHandlerTest.java"
},
"source": "https://github.com/vaadin/flow/commit/815b967fc84fefa8d3a4d72b9a036f48b0d96326",
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"88761532408362104243124548915240472006",
"26115545497482520410577718690440502402",
"11174849024622262841416345250865283229",
"84528676154298864545152016826230750574",
"278489075895345417307043855328577458086",
"184248164895372040317975779425110459888",
"219023934169466880833981601434994954349",
"121090698278751340858756785343313231219",
"2484675577778871304649568792269367086",
"472646401238229835898262101224063639",
"294378466201656383580273847132248219927",
"292359602663621118239833079456516038129",
"312436184117340029061677700511925478592",
"202899740439789292065858729706882250942",
"74406980481203728174455280537256204485",
"338995141612628595560954631266444936498",
"12714896774079731942982039562409971795"
],
"threshold": 0.9
},
"id": "CVE-2021-31408-92f44d17",
"target": {
"file": "flow-server/src/main/java/com/vaadin/flow/server/communication/IndexHtmlRequestHandler.java"
},
"source": "https://github.com/vaadin/flow/commit/815b967fc84fefa8d3a4d72b9a036f48b0d96326",
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 503.0,
"function_hash": "226243603720421541345503239346751960012"
},
"id": "CVE-2021-31408-a66e3a91",
"target": {
"function": "addInitialFlow",
"file": "flow-server/src/main/java/com/vaadin/flow/server/communication/IndexHtmlRequestHandler.java"
},
"source": "https://github.com/vaadin/flow/commit/815b967fc84fefa8d3a4d72b9a036f48b0d96326",
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 347.0,
"function_hash": "237078465224501216918970658909492001450"
},
"id": "CVE-2021-31408-b1cb02ae",
"target": {
"function": "generateChangesFromEmpty",
"file": "flow-server/src/main/java/com/vaadin/flow/internal/nodefeature/NodeList.java"
},
"source": "https://github.com/vaadin/flow/commit/6a409a8b4b01b18dc2ca30c59395aeeb0cffbd2c",
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"166633409631087626290913396734732436812",
"197369469223622540360828579482267148736",
"195140222273805224304426140183017972196",
"13725961261785800399221674383562159069",
"254809120351719464142745237772450809857",
"218073233907562093408731433265810115800",
"115598401893538929146075788865948813998",
"125696343857202907446740191536897790877",
"160714507295608243343753244293991626370",
"193520768097641661616424740431266394537",
"69994674005437863081726701270029049220",
"290354615757599555553062985667031195999",
"309531406710090212504351233874492144018",
"168869688385432029114419295455521740678",
"63934125460227180648737009602041294572",
"85556528253725332217195246397880446410",
"4550144445281353063207849036130384881",
"195696388440559866788998827604886889942",
"9141715159019342845708092688719018889",
"219517428722783548000327656944996394349",
"263174819385655843558517354193042800341",
"278628717958162781159499401632548149642",
"212108074043554686633359082740911042134",
"169975297854300739114179273258741891957",
"205737623842655635335622360341037817920",
"307280477213297565963444080109690997162",
"91811661610476284181762024379518805152",
"65259493187650283740785656083088485279",
"211259311801906745895310484723471516931",
"267825787843750070483517773643359595816",
"332891950888997778239207210083009721465",
"157413110011444433218980576423685117638",
"293332030890763288991054245397386344559",
"168725237606573335312901823970827696098",
"78467309573778413904335907284488736014",
"120630796013142002430213040883762815456"
],
"threshold": 0.9
},
"id": "CVE-2021-31408-f3fc00e1",
"target": {
"file": "flow-server/src/main/java/com/vaadin/flow/internal/nodefeature/NodeList.java"
},
"source": "https://github.com/vaadin/flow/commit/6a409a8b4b01b18dc2ca30c59395aeeb0cffbd2c",
"signature_version": "v1"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-31408.json"
vanir_signatures_modified
"2026-08-07T16:57:20Z"
Git / github.com/vaadin/platform
Affected ranges
- Type
- GIT
- Repo
- https://github.com/vaadin/platform
- Events
-
IntroducedFixedIntroducedLast affected
- Database specific
-
Show details
{ "source": [ "CPE_RANGE", "CPE_STRING" ], "cpe": [ "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "cpe:2.3:a:vaadin:vaadin:18.0.0:-:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "19.0.0" }, { "fixed": "19.0.4" }, { "introduced": "18.0.0-NA" }, { "last_affected": "18.0.0-NA" } ] }
Git / github.com/vaadin/vaadin
Affected ranges
- Type
- GIT
- Repo
- https://github.com/vaadin/vaadin
- Events
-
IntroducedFixedIntroducedLast affected
- Database specific
-
Show details
{ "source": [ "CPE_RANGE", "CPE_STRING" ], "cpe": [ "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "cpe:2.3:a:vaadin:vaadin:18.0.0:-:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "19.0.0" }, { "fixed": "19.0.4" }, { "introduced": "18.0.0-NA" }, { "last_affected": "18.0.0-NA" } ] }