mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-30 10:10:41 +00:00
207 lines
7.1 KiB
JSON
207 lines
7.1 KiB
JSON
|
{
|
||
|
|
"id": "CVE-2021-31404",
|
||
|
|
"sourceIdentifier": "security@vaadin.com",
|
||
|
|
"published": "2021-04-23T16:15:08.647",
|
||
|
|
"lastModified": "2021-04-30T19:00:46.753",
|
||
|
|
"vulnStatus": "Analyzed",
|
||
|
|
"descriptions": [
|
||
|
|
{
|
||
|
|
"lang": "en",
|
||
|
|
"value": "Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaadin 15 prior to 18), and 5.0.0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"lang": "es",
|
||
|
|
"value": "La comparaci\u00f3n non-constant-time de tokens CSRF en el manejador de peticiones UIDL en com.vaadin:flow-server versiones 1.0.0 hasta 1.0.13 (Vaadin versiones 10.0.0 hasta 10.0.16), versiones 1.1.0 anteriores a 2.0.0 (Vaadin versiones 11 anteriores a 14), versiones 2.0.0 hasta 2.4.6 (Vaadin versiones 14.0.0 hasta 14.4.6), versiones 3.0.0 anteriores a 5.0.0 (Vaadin versiones 15 anteriores a 18) y versiones 5.0.0 hasta 5.0.2 (Vaadin versiones 18.0.0 hasta 18.0.5), permite al atacante adivinar un token de seguridad por medio de un ataque de sincronizaci\u00f3n"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"metrics": {
|
||
|
|
"cvssMetricV31": [
|
||
|
|
{
|
||
|
|
"source": "nvd@nist.gov",
|
||
|
|
"type": "Primary",
|
||
|
|
"cvssData": {
|
||
|
|
"version": "3.1",
|
||
|
|
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
||
|
|
"attackVector": "LOCAL",
|
||
|
|
"attackComplexity": "HIGH",
|
||
|
|
"privilegesRequired": "LOW",
|
||
|
|
"userInteraction": "NONE",
|
||
|
|
"scope": "UNCHANGED",
|
||
|
|
"confidentialityImpact": "LOW",
|
||
|
|
"integrityImpact": "NONE",
|
||
|
|
"availabilityImpact": "NONE",
|
||
|
|
"baseScore": 2.5,
|
||
|
|
"baseSeverity": "LOW"
|
||
|
|
},
|
||
|
|
"exploitabilityScore": 1.0,
|
||
|
|
"impactScore": 1.4
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"source": "security@vaadin.com",
|
||
|
|
"type": "Secondary",
|
||
|
|
"cvssData": {
|
||
|
|
"version": "3.1",
|
||
|
|
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
||
|
|
"attackVector": "LOCAL",
|
||
|
|
"attackComplexity": "HIGH",
|
||
|
|
"privilegesRequired": "NONE",
|
||
|
|
"userInteraction": "NONE",
|
||
|
|
"scope": "UNCHANGED",
|
||
|
|
"confidentialityImpact": "LOW",
|
||
|
|
"integrityImpact": "LOW",
|
||
|
|
"availabilityImpact": "NONE",
|
||
|
|
"baseScore": 4.0,
|
||
|
|
"baseSeverity": "MEDIUM"
|
||
|
|
},
|
||
|
|
"exploitabilityScore": 1.4,
|
||
|
|
"impactScore": 2.5
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"cvssMetricV2": [
|
||
|
|
{
|
||
|
|
"source": "nvd@nist.gov",
|
||
|
|
"type": "Primary",
|
||
|
|
"cvssData": {
|
||
|
|
"version": "2.0",
|
||
|
|
"vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
|
||
|
|
"accessVector": "LOCAL",
|
||
|
|
"accessComplexity": "MEDIUM",
|
||
|
|
"authentication": "NONE",
|
||
|
|
"confidentialityImpact": "PARTIAL",
|
||
|
|
"integrityImpact": "NONE",
|
||
|
|
"availabilityImpact": "NONE",
|
||
|
|
"baseScore": 1.9
|
||
|
|
},
|
||
|
|
"baseSeverity": "LOW",
|
||
|
|
"exploitabilityScore": 3.4,
|
||
|
|
"impactScore": 2.9,
|
||
|
|
"acInsufInfo": false,
|
||
|
|
"obtainAllPrivilege": false,
|
||
|
|
"obtainUserPrivilege": false,
|
||
|
|
"obtainOtherPrivilege": false,
|
||
|
|
"userInteractionRequired": false
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"weaknesses": [
|
||
|
|
{
|
||
|
|
"source": "nvd@nist.gov",
|
||
|
|
"type": "Primary",
|
||
|
|
"description": [
|
||
|
|
{
|
||
|
|
"lang": "en",
|
||
|
|
"value": "CWE-203"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"source": "security@vaadin.com",
|
||
|
|
"type": "Secondary",
|
||
|
|
"description": [
|
||
|
|
{
|
||
|
|
"lang": "en",
|
||
|
|
"value": "CWE-208"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"configurations": [
|
||
|
|
{
|
||
|
|
"nodes": [
|
||
|
|
{
|
||
|
|
"operator": "OR",
|
||
|
|
"negate": false,
|
||
|
|
"cpeMatch": [
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*",
|
||
|
|
"versionStartIncluding": "1.0.0",
|
||
|
|
"versionEndExcluding": "1.0.14",
|
||
|
|
"matchCriteriaId": "8B6B73DE-1089-401A-8E6E-31938A277F6F"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*",
|
||
|
|
"versionStartIncluding": "1.1.0",
|
||
|
|
"versionEndExcluding": "2.0.0",
|
||
|
|
"matchCriteriaId": "EA762C83-724A-4D14-B4C4-9824799B2999"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*",
|
||
|
|
"versionStartIncluding": "2.0.0",
|
||
|
|
"versionEndExcluding": "2.4.7",
|
||
|
|
"matchCriteriaId": "409F92E2-6634-4596-BD66-FBD46E45E658"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*",
|
||
|
|
"versionStartIncluding": "3.0.0",
|
||
|
|
"versionEndExcluding": "5.0.0",
|
||
|
|
"matchCriteriaId": "796C0FAD-172F-4186-847E-5312F3664734"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*",
|
||
|
|
"versionStartIncluding": "5.0.0",
|
||
|
|
"versionEndExcluding": "5.0.3",
|
||
|
|
"matchCriteriaId": "53839127-7CF7-4BDC-BC21-29DF165B2BB0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
|
||
|
|
"versionStartIncluding": "10.0.0",
|
||
|
|
"versionEndExcluding": "10.0.17",
|
||
|
|
"matchCriteriaId": "18A7C1CA-ED82-43FD-A3FC-68CC66D17B96"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
|
||
|
|
"versionStartIncluding": "11.0.0",
|
||
|
|
"versionEndExcluding": "14.0.0",
|
||
|
|
"matchCriteriaId": "06E47D63-52A7-4B6A-B90F-7692D854DECC"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
|
||
|
|
"versionStartIncluding": "14.0.0",
|
||
|
|
"versionEndExcluding": "14.4.7",
|
||
|
|
"matchCriteriaId": "C13F08D0-2AB9-4B27-B023-59B9F43626F6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
|
||
|
|
"versionStartIncluding": "15.0.0",
|
||
|
|
"versionEndExcluding": "17.0.0",
|
||
|
|
"matchCriteriaId": "2D0B97C7-D17B-4006-AFE6-707F1290E39E"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
|
||
|
|
"versionStartIncluding": "18.0.0",
|
||
|
|
"versionEndExcluding": "18.0.6",
|
||
|
|
"matchCriteriaId": "C06D13A9-529D-4523-BA83-AC217FF63808"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"references": [
|
||
|
|
{
|
||
|
|
"url": "https://github.com/vaadin/flow/pull/9875",
|
||
|
|
"source": "security@vaadin.com",
|
||
|
|
"tags": [
|
||
|
|
"Patch",
|
||
|
|
"Third Party Advisory"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"url": "https://vaadin.com/security/cve-2021-31404",
|
||
|
|
"source": "security@vaadin.com",
|
||
|
|
"tags": [
|
||
|
|
"Vendor Advisory"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|