Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8
Vulnerability Description
Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security token via timing attack
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Vulnerability Type
通过时间差异性导致的信息暴露
Vulnerability Title
Vaadin framework 安全漏洞
Vulnerability Description
Vaadin framework是一个应用软件。一个使用纯Java有效地构建现代Web应用程序，而无需接触低级Web技术得应用框架。 Vaadin framework 存在安全漏洞，该漏洞允许攻击者通过定时攻击猜测安全令牌。以下产品及版本受到影响：com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 throug
CVSS Information
N/A
Vulnerability Type
N/A