GitHub Advisoryadvisory · Maven

GHSA-p826-8vhq-h439 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19

HIGH Published 2021-05-06 Modified 2021-05-19 Official page ↗
Aliases
CVE-2021-31411
Ecosystem
Maven
Packages
com.vaadin:vaadin-bom
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-379
Reviewed
2021-05-04

Affected packages

• Maven com.vaadin:vaadin-bom: >= 14.0.3, < 14.5.3 → fixed in 14.5.3 • Maven com.vaadin:vaadin-bom: >= 15.0.0, < 19.0.5 → fixed in 19.0.5

Description

Insecure temporary directory usage in frontend build functionality of `com.vaadin:flow-server` versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to inject malicious code into frontend resources during application rebuilds. • https://vaadin.com/security/cve-2021-31411

Related

Alias · CVE (1)

  • CVE-2021-31411 Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3… vulnerability

Weakness · CWE (1)

  • CWE-379 Creation of Temporary File in Directory with Insecure Permissions weakness

References