{"action":"Upgrade com.vaadin:vaadin-bom to 10.0.17 (10.x), 14.4.7 (14.x) or 18.0.6 (18.x) or later.","affected":[{"fixed":"10.0.17","introduced":"10.0.0"},{"fixed":"14.4.7","introduced":"11.0.0"},{"fixed":"18.0.6","introduced":"15.0.0"}],"component":"com.vaadin:vaadin-bom","cve_ids":[],"ecosystem":"Maven","exploited":false,"fixed_versions":["10.0.17","14.4.7","18.0.6"],"ghsa_id":"GHSA-c6c4-7x48-4cqp","id":"tcs_01M5N8RQH9XXHWEWYDPN1MHCP2","modified_at":"2024-12-02T05:39:52.682940Z","published_at":"2021-04-19T14:47:47Z","references":["https://osv.dev/vulnerability/GHSA-c6c4-7x48-4cqp","https://github.com/vaadin/platform/security/advisories/GHSA-c6c4-7x48-4cqp","https://github.com/vaadin/platform","https://vaadin.com/security/cve-2021-31404"],"severity":{"label":"medium","score":4},"sources":[{"source":"osv","source_id":"GHSA-c6c4-7x48-4cqp","url":"https://osv.dev/vulnerability/GHSA-c6c4-7x48-4cqp"}],"summary":"Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18"}