Is CVE-2021-31412 actively exploited?

No active exploitation of CVE-2021-31412 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2021-31412 be exploited remotely?

Yes. CVE-2021-31412 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2021-31412?

CVE-2021-31412 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2021-31412

MEDIUM

CVE-2021-31412

CWE-1295Published: June 24, 2021· Updated: Jun 17, 2026

5.3

CVSS v3.1

Official Description

Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for NotFoundException is provided.

NVD Source

Technical Analysis

CVE-2021-31412 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.