GitHub Advisoryadvisory · Maven

GHSA-c57f-4vp2-jqhm Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19

MEDIUM Published 2021-05-06 Modified 2021-10-05 Official page ↗
Ecosystem
Maven
Packages
com.vaadin:flow-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-379
Reviewed
2021-05-04

Affected packages

• Maven com.vaadin:flow-server: >= 2.0.9, < 2.5.3 → fixed in 2.5.3 • Maven com.vaadin:flow-server: >= 3.0.0, < 6.0.6 → fixed in 6.0.6

Description

Insecure temporary directory usage in frontend build functionality of `com.vaadin:flow-server` versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to inject malicious code into frontend resources during application rebuilds. • https://vaadin.com/security/cve-2021-31411

Related

Weakness · CWE (1)

  • CWE-379 Creation of Temporary File in Directory with Insecure Permissions weakness

References