CVEvulnerability

CVE-2021-33604

2.5 LOW Published 2021-06-24 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-06-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
2.5 LOW — CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
2.5 LOW — CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
1.2 LOW — AV:L/AC:H/Au:N/C:P/I:N/A:N
Weaknesses
CWE-172

Description

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

Affected configurations

• vaadin flow-server (>= 2.0.0 <= 2.6.1) • vaadin flow-server (>= 3.0.0 <= 5.0.0) • vaadin flow-server (>= 6.0.0 <= 6.0.9) • vaadin vaadin (>= 14.0.0 <= 14.6.1) • vaadin vaadin (>= 15.0.0 <= 18.0.0) • vaadin vaadin (>= 19.0.0 <= 19.0.8)

Related

Weakness · CWE (1)

  • CWE-172 Improper Encoding or Decoding of Data weakness

References