GitHub Advisoryadvisory · Maven

GHSA-82mf-mmh7-hxp5 Directory traversal in development mode handler in Vaadin 14 and 15-17

MEDIUM Published 2021-04-19 Modified 2021-10-08 Official page ↗
Ecosystem
Maven
Packages
com.vaadin:vaadin-bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-20
Reviewed
2021-04-16

Affected packages

• Maven com.vaadin:vaadin-bom: >= 14.0.0, < 14.4.3 → fixed in 14.4.3 • Maven com.vaadin:vaadin-bom: >= 15.0.0, < 18.0.0 → fixed in 18.0.0

Description

Improper URL validation in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder. • https://vaadin.com/security/cve-2020-36321

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References