{"id":"CVE-2021-31412","details":"Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for NotFoundException is provided.","aliases":["GHSA-qrg9-f472-qwfm"],"modified":"2026-08-07T16:57:20.466519Z","published":"2021-06-24T12:15:08.090Z","references":[{"type":"ADVISORY","url":"https://vaadin.com/security/cve-2021-31412"},{"type":"FIX","url":"https://github.com/vaadin/flow/pull/11107"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vaadin/flow","events":[{"introduced":"3cd0c02025aba6de6fd78a8ea65c67483a721b4e"},{"last_affected":"3a0bec8198b110458ccea3d5165de9d402817426"},{"introduced":"6b0da5b1d88e4541bebb4f26ef799b3f407bb74e"},{"last_affected":"51ab210c480feb216183721e7dec0bc990d4a11c"},{"introduced":"8e306579f157678c3baa3f3f63f406d073668161"},{"last_affected":"028ba87748c990948f44fe47c6b680c8b5e197d2"},{"introduced":"4b6ca4330163c4e976b32d03880fe2154a9d1ca7"},{"last_affected":"60b4fd8e59948e2a6a5f8af1988a3adc45563ffc"},{"introduced":"6a409a8b4b01b18dc2ca30c59395aeeb0cffbd2c"},{"last_affected":"9ebb07ae013fd667dec105c9cde3aaf9acc23e81"}],"database_specific":{"cpe":"cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.0.0"},{"last_affected":"1.0.14"},{"introduced":"1.1.0"},{"last_affected":"1.4.0"},{"introduced":"2.0.0"},{"last_affected":"2.6.1"},{"introduced":"3.0.0"},{"last_affected":"5.0.0"},{"introduced":"6.0.0"},{"last_affected":"6.0.9"}],"source":"CPE_RANGE"}}],"versions":["1.0.14","6.0.9","2.6.1","2.6.0","6.0.8","2.6.0.rc1","6.0.7","6.0.6","2.6.0.beta2","6.0.5","2.6.0.beta1","6.0.4","2.6.0.alpha1","6.0.3","6.0.2","6.0.1","6.0.0.rc1","6.0.0","2.5.0.alpha2","2.5.0.alpha1","5.0.0","5.0.0.rc1","5.0.0.beta1","2.4.0","5.0.0.alpha1","2.4.0.beta2","2.4.0.beta1","2.4.0.alpha1","2.3.4","2.3.3","4.0.0.beta1","2.3.2","4.0.0.alpha3","2.3.1","4.0.0.alpha2","2.3.0","4.0.0.alpha1","2.3.0.beta3","2.3.0.beta2","3.2.0.alpha7","2.3.0.beta1","3.2.0.alpha6","3.2.0.alpha5","3.2.0.alpha4","2.3.0.alpha1","2.2.0.rc1","3.2.0.alpha3","2.2.0.beta2","3.2.0.alpha2","2.2.0.beta1","3.2.0.alpha1","2.2.0.alpha16","2.2.0.alpha15","2.2.0.alpha14","3.0.0.beta2","2.2.alpha14","3.0.0.beta4","3.0.0.beta3","2.2.0.alpha13","3.0.0.beta1","3.0.0.alpha17","2.2.0.alpha12","2.2.0.alpha11","2.2.0.alpha10","2.2.0.alpha9","2.2.0.alpha8","2.2.0.alpha7","2.2.0.alpha6","2.2.0.alpha5","2.2.0.alpha4","2.2.0.alpha3","2.2.0.alpha2","2.2.0.alpha1","2.1.0.beta3","3.0.0.alpha5","1.3.0","2.1.0.beta1","2.1.0.alpha1","1.0.13","2.0.8","2.0.7","2.0.6","1.0.12","2.0.5","2.0.4","2.0.3","2.0.2","2.0.1","2.0.0","1.0.11","1.0.10","1.0.9","1.4.0","1.0.8","1.3.0.beta2","1.3.0.beta1","1.0.7","1.0.6","1.2.0","1.2.0.beta2","1.2.0.beta1","1.2.0.alpha1","1.1.0","1.0.5","1.0.4","1.0.3","1.0.2","1.0.1","1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-31412.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/vaadin/platform","events":[{"introduced":"8e1b5f1a3f9bb984108d172f19d4d2df4a1987f5"},{"last_affected":"57cf051432858e7c43b9beef039ee5e9d0d7b5e3"},{"introduced":"b1b5f755102e03fab90c511f4b207d394cbca8fb"},{"last_affected":"f0af87e5666e8286802194b0c37e3be707ae3c85"},{"introduced":"1497812ad40b7ff90bef8bdb28808afc8d7194d1"},{"last_affected":"18d5f285f900b35a26b53d3b99c19ebf38aa7f24"},{"introduced":"354ad0186b5e61b548adad84de03af297dc6f2a6"},{"last_affected":"0f6048aefc10582e3042adb05064dac232f2f2c9"},{"introduced":"5c28d4e1b9099122cf4d770283777f00a960aab3"},{"last_affected":"75f1480f498fae93a7ba1d909e0fe4d45ea31fc6"}],"database_specific":{"cpe":"cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"10.0.0"},{"last_affected":"10.0.18"},{"introduced":"11.0.0"},{"last_affected":"13.0.0"},{"introduced":"14.0.0"},{"last_affected":"14.6.1"},{"introduced":"15.0.0"},{"last_affected":"18.0.0"},{"introduced":"19.0.0"},{"last_affected":"19.0.8"}],"source":"CPE_RANGE"}}],"versions":["10.0.18","14.6.1","19.0.8","19.0.7","14.6.0","14.6.0.rc1","14.6.0.beta2","19.0.6","19.0.5","14.6.0.beta1","19.0.4","19.0.3","14.6.0.alpha2","19.0.2","14.6.0.alpha1","14.5.0.rc1","19.0.1","19.0.0","14.5.0.beta1","14.5.0.alpha3","14.5.0.alpha2","14.5.0.alpha1","18.0.0","18.0.0.rc2","18.0.0.rc1","18.0.0.beta3","18.0.0.beta2","18.0.0.beta1","18.0.0.alpha1","14.4.0","14.4.0.rc1","14.4.0.beta2","14.4.0.beta1","14.4.0.alpha1","17.0.0","17.0.0.rc2","17.0.0.rc1","17.0.0.beta3","17.0.0.beta2","17.0.0.beta1","17.0.0.alpha7","17.0.0.alpha6","16.0.1","14.3.0.rc1","14.3.0","14.3.0.beta3","17.0.0.alpha5","14.3.0.beta2","14.3.0.beta1","17.0.0.alpha4","17.0.0.alpha3","17.0.0.alpha2","14.3.0.alpha1","14.2.0","14.2.0.rc1","14.2.0.beta1","16.0.0.alpha3","16.0.0.alpha2","14.2.0.alpha11","16.0.0.alpha1","14.2.0.alpha10","14.2.0.alpha9","14.2.0.alpha8","14.2.0.alpha7","14.2.0.alpha6","15.0.0.rc1","15.0.0","14.2.0.alpha5","14.2.0.alpha4","10.0.17","14.2.0.alpha3","14.2.0.alpha2","14.2.0.alpha1","14.1.2","14.1.1","14.1.0","14.1.0.beta2","14.1.0.beta1","14.1.0.alpha3","14.1.0.alpha1","14.0.2","14.0.1","14.0.0","10.0.16","10.0.15","10.0.14","10.0.13","10.0.12","10.0.11","13.0.0","13.0.0.beta3","13.0.0.beta2","13.0.0.beta1","13.0.0.alpha4","13.0.0.alpha3","13.0.0.alpha2","10.0.10","13.0.0.alpha1","10.0.9","10.0.8","10.0.7","12.0.0.beta2","12.0.0.beta1","12.0.0.alpha5","12.0.0.alpha4","10.0.6","12.0.0.alpha3","12.0.0.alpha2","12.0.0.alpha1","10.0.5","10.0.4","10.0.3","11.0.0.beta1","11.0.0.alpha1","10.0.2","10.0.1","10.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-31412.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/vaadin/vaadin","events":[{"introduced":"7ac406600a3c1a228e15ba253fe844f7e13771a0"},{"last_affected":"6ad5c47f51489cb4b99844255a7b6f676a6d82df"},{"introduced":"75cb16838a5b87c6e1a15b9e453e0d7c90cc1d53"},{"last_affected":"ec066cd66dc30136955201c14b8c786663e4fa93"},{"introduced":"ca9cf99092245a31a84b317adf1d79a397970d27"},{"last_affected":"e19775cf4b00eb14e98acd9b0452642c2a7010ff"},{"introduced":"9efda1b1e0a27769eef9292dd7799d8fea77e633"},{"last_affected":"a5bc6b4832e649fb16243e2bc0ee9b2941815e3b"},{"introduced":"3981409421683b6f4a796f37b67433d36b6a7ca1"},{"last_affected":"b41a52e3d8a4d4e90726e15cba6e2ae31b4722ba"}],"database_specific":{"cpe":"cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"10.0.0"},{"last_affected":"10.0.18"},{"introduced":"11.0.0"},{"last_affected":"13.0.0"},{"introduced":"14.0.0"},{"last_affected":"14.6.1"},{"introduced":"15.0.0"},{"last_affected":"18.0.0"},{"introduced":"19.0.0"},{"last_affected":"19.0.8"}],"source":"CPE_RANGE"}}],"versions":["v10.0.18","v19.0.8","v14.6.1","v19.0.7","v14.6.0","v14.6.0-rc1","v19.0.6","v14.6.0-beta2","v19.0.5","v14.6.0-beta1","v19.0.4","v14.6.0-alpha2","v19.0.3","v14.6.0-alpha1","v19.0.2","v14.5.0-rc1","v19.0.1","v14.5.0-beta1","v19.0.0","v14.5.0-alpha3","v14.5.0-alpha2","v10.0.17","v14.5.0-alpha1","v14.4.0","v18.0.0-beta2","v18.0.0","v18.0.0-rc2","v18.0.0-rc1","v18.0.0-beta3","v18.0.0-beta1","v18.0.0-alpha1","v17.0.0","v14.4.0-rc1","v14.4.0-beta2","v14.4.0-beta1","v14.4.0-alpha1","v17.0.0-rc1","v14.3.0","v17.0.0-rc2","v17.0.0-beta3","v17.0.0-beta2","v17.0.0-beta1","v17.0.0-alpha7","v17.0.0-alpha6","v17.0.0-alpha5","v14.3.0-rc1","v14.3.0-beta3","v17.0.0-alpha4","v14.3.0-beta2","v14.3.0-beta1","v14.3.0-alpha1","v17.0.0-alpha3","v14.2.0","v17.0.0-alpha2","v17.0.0-alpha1","v16.0.0-alpha3","v14.2.0-rc1","v14.2.0-beta1","v14.2.0-alpha11","v16.0.0-alpha2","v16.0.0-alpha1","v14.2.0-alpha10","v15.0.0-rc1","v14.2.0-alpha9","v14.2.0-alpha8","v14.2.0-alpha7","v14.2.0-alpha6","v14.2.0-alpha5","v15.0.0-beta5","v14.2.0-alpha4","v15.0.0-beta4","v15.0.0-beta3","v15.0.0-beta2","v15.0.0-beta1","v14.2.0-alpha3","v15.0.0-alpha15","v15.0.0-alpha14","v15.0.0-alpha13","v15.0.0-alpha12","v15.0.0-alpha11","v14.2.0-alpha2","v15.0.0-alpha10","v14.2.0-alpha1","v14.1.2","v15.0.0-alpha9","v15.0.0-alpha8","v15.0.0-alpha7","v14.1.1","v15.0.0-alpha6","v15.0.0-alpha5","v14.1.0","v14.1.0-rc1","v15.0.0-alpha4","v14.1.0-beta3","v14.1.0-beta2","v14.1.0-beta1","v15.0.0-alpha3","v14.1.0-alpha5","v15.0.0-alpha2","v14.1.0-alpha4","v14.1.0-alpha3","v14.1.0-alpha2","v15.0.0-alpha1","v14.1.0-alpha1","v14.0.2","v10.0.16","v14.0.1","v14.0.0","v10.0.15","v10.0.14","v10.0.13","v10.0.12","v10.0.11","v13.0.0","v13.0.0-beta3","v13.0.0-beta2","v10.0.10","v13.0.0-beta1","v13.0.0-alpha4","v13.0.0-alpha3","v13.0.0-alpha2","v13.0.0-alpha1","v10.0.9","v12.0.2","v12.0.1","v12.0.0","v12.0.0-beta2","v10.0.8","v10.0.7","v12.0.0-beta1","v10.0.6","v12.0.0-alpha5","v12.0.0-alpha4","v12.0.0-alpha3","v12.0.0-alpha2","v12.0.0-alpha1","v10.0.5","v10.0.4","v10.0.3","v10.0.2","v11.0.0-beta1","v11.0.0-alpha1","v10.0.1","v10.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-31412.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}