{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-18T04:05:16.075","vulnerabilities":[{"cve":{"id":"CVE-2021-31408","sourceIdentifier":"security@vaadin.com","published":"2021-04-23T17:15:08.260","lastModified":"2024-11-21T06:05:36.240","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out."},{"lang":"es","value":"El asistente Authentication.logout() en com.vaadin:flow-client versiones  5.0.0 anteriores a 6.0.0 (Vaadin 18) y versiones 6.0.0 hasta 6.0.4 (versiones Vaadin 19.0.0 hasta 19.0.3) usan un método HTTP incorrecto , que, en combinación con la protección CSRF de Spring Security, permite a atacantes locales acceder a endpoints de Fusion después de que el usuario intenta cerrar la sesión"}],"metrics":{"cvssMetricV31":[{"source":"security@vaadin.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:M/Au:N/C:P/I:P/A:N","baseScore":3.3,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.4,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"security@vaadin.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-613"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"6.0.0","matchCriteriaId":"138C0A40-EC8F-4F6F-B907-1F5282B83958"},{"vulnerable":true,"criteria":"cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.0.5","matchCriteriaId":"B9CCDECF-655E-48E5-ADEC-F5189C6E043D"},{"vulnerable":true,"criteria":"cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*","versionStartIncluding":"19.0.0","versionEndExcluding":"19.0.4","matchCriteriaId":"74A5FA0C-C1AE-496E-8601-A9CC193F750E"},{"vulnerable":true,"criteria":"cpe:2.3:a:vaadin:vaadin:18.0.0:-:*:*:*:*:*:*","matchCriteriaId":"B0C90C81-A26F-4686-BC0C-6D86C3620F5C"}]}]}],"references":[{"url":"https://github.com/vaadin/flow/pull/10577","source":"security@vaadin.com","tags":["Patch","Third Party Advisory"]},{"url":"https://vaadin.com/security/cve-2021-31408","source":"security@vaadin.com","tags":["Vendor Advisory"]},{"url":"https://github.com/vaadin/flow/pull/10577","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://vaadin.com/security/cve-2021-31408","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}