CVE-2021-31408

HIGH Year: 2021
CVSS v3 Score
7.1
High
CVSS v2 Score
3.3
Low
Weakness Type
CWE-613
View all →

Vulnerability Description

Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.

Related Vulnerabilities

CVE-2019-5647

HIGH
CVSS:7.1(High)

The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacki...

CWE-6132019

CVE-2020-5774

HIGH
CVSS:7.1(High)

Nessus versions 8.11.0 and earlier were found to maintain sessions longer than the permitted period in certain scenarios. The lack of proper session expiration could allow attackers with local access ...

CWE-6132020

CVE-2021-3461

HIGH
CVSS:7.1(High)

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name].

CWE-6132021

CVE-2023-40025

HIGH
CVSS:7.1(High)

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting from version 2.6.0 have a bug where open web terminal sessions do not expire. This bug allows...

CWE-6132023

CVE-2024-45187

HIGH
CVSS:7.1(High)

Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code throu...

CWE-6132024

CVE-2024-45462

HIGH
CVSS:7.1(High)

The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend service. An attacker that has access to a...

CWE-6132024