CVEvulnerability

CVE-2018-25007

4.3 MEDIUM Published 2021-04-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-04-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
2.6 LOW — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
Weaknesses
CWE-754

Description

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

Affected configurations

• vaadin flow (>= 1.0.0 < 1.0.6) • vaadin vaadin (>= 10.0.0 < 10.0.8) • vaadin vaadin (>= 11.0.0 < 11.0.3)

Related

Weakness · CWE (1)

  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness

References