GHSA-mr8h-j9cv-4m8h

Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-31408

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.vaadin:vaadin-bom	>= 18.0.0, < 19.0.4	19.0.4

Details

As written in the advisory (Markdown source, shown as plain text).

`Authentication.logout()` helper in `com.vaadin:flow-client` versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out. - https://vaadin.com/security/cve-2021-31408

References

External links from the advisory. They lead to third-party sites.

https://github.com/vaadin/platform/security/advisories/GHSA-mr8h-j9cv-4m8h web
https://nvd.nist.gov/vuln/detail/CVE-2021-31408 advisory
https://github.com/vaadin/flow/pull/10577 web
https://vaadin.com/security/cve-2021-31408 web