GitHub Advisoryadvisory · Maven

GHSA-49r2-73m6-pp8f Directory traversal in development mode handler in Vaadin 14 and 15-17

MEDIUM Published 2021-04-19 Modified 2021-04-23 Official page ↗
Aliases
CVE-2020-36321
Ecosystem
Maven
Packages
com.vaadin:flow-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-20, CWE-22
Reviewed
2021-04-16

Affected packages

• Maven com.vaadin:flow-server: >= 3.0.0, < 5.0.0 → fixed in 5.0.0 • Maven com.vaadin:flow-server: >= 2.0.0, < 2.4.2 → fixed in 2.4.2

Description

Improper URL validation in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder. • https://vaadin.com/security/cve-2020-36321

Related

Alias · CVE (1)

  • CVE-2020-36321 Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2),… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References