« Volver al listado

CVE-2021-31405

Estado: ModificadaAlta (7.5)—

Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Vaadin — FlowVaadin — Vaadin

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-31405",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vaadin.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@vaadin.com",
      "affectedData": [
        {
          "vendor": "Vaadin",
          "product": "Vaadin",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "15.0.0",
                  "status": "affected"
                }
              ],
              "version": "14.0.6",
              "lessThan": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Vaadin",
          "product": "vaadin-text-field-flow",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.0.0",
                  "status": "affected"
                }
              ],
              "version": "2.0.4",
              "lessThan": "*",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-04-23T16:15:08.687",
  "references": [
    {
      "url": "https://github.com/vaadin/flow-components/pull/442",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security@vaadin.com"
    },
    {
      "url": "https://vaadin.com/security/cve-2021-31405",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@vaadin.com"
    },
    {
      "url": "https://github.com/vaadin/flow-components/pull/442",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://vaadin.com/security/cve-2021-31405",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@vaadin.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses."
    },
    {
      "lang": "es",
      "value": "Una comprobación no segura de RegEx en el componente EmailField en com.vaadin:vaadin-text-field-flow versiones 2.0.4 hasta 2.3.2 (Vaadin versiones 14.0.6 hasta 14.4.3) y versiones 3.0.0 hasta 4.0.2 (Vaadin versiones 15.0.0 hasta 17.0.10), permite a atacantes causar un consumo de recursos no controlado mediante el envío de direcciones de correo electrónico maliciosas"
    }
  ],
  "lastModified": "2026-06-17T03:51:43.170",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74EA30C3-4C81-4C39-8EB8-75BB8A3BF1C9",
              "versionEndExcluding": "2.3.3",
              "versionStartIncluding": "2.0.4"
            },
            {
              "criteria": "cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F972BCA-7736-42A8-A676-656183AB1096",
              "versionEndExcluding": "4.0.3",
              "versionStartIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78D36620-0467-4D06-9228-B1F21CD7CC45",
              "versionEndExcluding": "14.4.4",
              "versionStartIncluding": "14.0.6"
            },
            {
              "criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C540D0C-0B64-49FB-87B7-9D856C31154F",
              "versionEndExcluding": "17.0.11",
              "versionStartIncluding": "15.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vaadin.com"
}