GitHub Advisoryadvisory · Maven

GHSA-j9wr-49vq-rm5g Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19

HIGH Published 2021-04-19 Modified 2021-10-08 Official page ↗
Ecosystem
Maven
Packages
com.vaadin:vaadin-bom
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-402
Reviewed
2021-04-16

Affected packages

• Maven com.vaadin:vaadin-bom: >= 12.0.0, < 14.4.10 → fixed in 14.4.10 • Maven com.vaadin:vaadin-bom: >= 19.0.0, < 19.0.1 → fixed in 19.0.1

Description

Vulnerability in OSGi integration in `com.vaadin:flow-server` versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request. • https://vaadin.com/security/cve-2021-31407

Related

Weakness · CWE (1)

  • CWE-402 Transmission of Private Resources into a New Sphere weakness

References