CVE-2021-31412

Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for NotFoundException is provided.
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*
cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*
cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*
cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*
cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*
cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*
cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*
cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*
cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*
cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:05

Type Values Removed Values Added
References () https://github.com/vaadin/flow/pull/11107 - Patch, Third Party Advisory () https://github.com/vaadin/flow/pull/11107 - Patch, Third Party Advisory
References () https://vaadin.com/security/cve-2021-31412 - Vendor Advisory () https://vaadin.com/security/cve-2021-31412 - Vendor Advisory

25 Oct 2022, 19:33

Type Values Removed Values Added
CWE CWE-668 CWE-20

30 Jun 2021, 15:10

Type Values Removed Values Added
CPE cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*
cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*
References (CONFIRM) https://vaadin.com/security/cve-2021-31412 - (CONFIRM) https://vaadin.com/security/cve-2021-31412 - Vendor Advisory
References (CONFIRM) https://github.com/vaadin/flow/pull/11107 - (CONFIRM) https://github.com/vaadin/flow/pull/11107 - Patch, Third Party Advisory
CVSS v2 : unknown
v3 : unknown
v2 : 4.3
v3 : 5.3
CWE CWE-668

24 Jun 2021, 13:14

Type Values Removed Values Added
New CVE

Information

Published : 2021-06-24 12:15

Updated : 2024-11-21 06:05


NVD link : CVE-2021-31412

Mitre link : CVE-2021-31412

CVE.ORG link : CVE-2021-31412


JSON object : View

Products Affected

vaadin

  • flow
  • vaadin
CWE
CWE-1295

Debug Messages Revealing Unnecessary Information

CWE-20

Improper Input Validation