GHSA-9h6g-6mxg-vvp4

Suggest an improvement
Source
https://github.com/advisories/GHSA-9h6g-6mxg-vvp4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-9h6g-6mxg-vvp4/GHSA-9h6g-6mxg-vvp4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9h6g-6mxg-vvp4
Published
2021-04-19T14:47:18Z
Modified
2024-12-02T05:45:00Z
Severity
  • 4.0 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Timing side channel vulnerability in endpoint request handler in Vaadin 15-19
Details

Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.

Database specific 
{
    "cwe_ids":  [
        "CWE-208"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2021-04-16T23:13:06Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

Maven / com.vaadin:vaadin-bom

Package

Name
com.vaadin:vaadin-bom
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin-bom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
19.0.0
Fixed
19.0.1

Affected versions

19.*
19.0.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-9h6g-6mxg-vvp4/GHSA-9h6g-6mxg-vvp4.json"

Maven / com.vaadin:vaadin-bom

Package

Name
com.vaadin:vaadin-bom
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin-bom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15.0.0
Fixed
18.0.7

Affected versions

15.*
15.0.0
15.0.1
15.0.2
15.0.3
15.0.4
15.0.5
15.0.6
16.*
16.0.0
16.0.1
16.0.2
16.0.3
16.0.4
16.0.5
17.*
17.0.0
17.0.1
17.0.2
17.0.3
17.0.4
17.0.6
17.0.7
17.0.8
17.0.9
17.0.10
17.0.11
18.*
18.0.0
18.0.1
18.0.2
18.0.3
18.0.4
18.0.5
18.0.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-9h6g-6mxg-vvp4/GHSA-9h6g-6mxg-vvp4.json"