GitHub Advisoryadvisory · Maven

GHSA-c99r-67x4-whj6 Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19

LOW Published 2021-06-28 Modified 2021-10-05 Official page ↗
Aliases
CVE-2021-33604
Ecosystem
Maven
Packages
com.vaadin:vaadin-bom
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-172
Reviewed
2021-06-24

Affected packages

• Maven com.vaadin:vaadin-bom: >= 14.0.0, < 14.6.2 → fixed in 14.6.2 • Maven com.vaadin:vaadin-bom: >= 15.0.0, < 19.0.9 → fixed in 19.0.9

Description

URL encoding error in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser. • https://vaadin.com/security/cve-2021-33604

Related

Alias · CVE (1)

  • CVE-2021-33604 URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0… vulnerability

Weakness · CWE (1)

  • CWE-172 Improper Encoding or Decoding of Data weakness

References