Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 before 6.0.0 (Vaadin 18), and 6.0.0 up to and including 6.0.4 (Vaadin 19.0.0 up to and including 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local malicious users to access Fusion endpoints after the user attempted to log out.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|