Vulnerability · Published Jun 24, 2021 · Assigned by Vaadin
CVE-2021-33604Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19
Low 2.5
In plain English
A low-severity security flaw in flow-server from Vaadin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)2.5Low
Exploit odds (30 days)0.3%top 78.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.vaadin:vaadin-bom | 14.6.2 | GHSA-c99r-67x4-whj6 |
| Maven | com.vaadin:vaadin-bom | 19.0.9 | GHSA-c99r-67x4-whj6 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Vaadin | Vaadin | 14.0.0 – before unspecifiedunspecified – through 14.6.115.0.0 – before unspecifiedunspecified – through 19.0.8 |
| Vaadin | flow-server | 2.0.0 – before unspecifiedunspecified – through 2.6.13.0.0 – before unspecifiedunspecified – through 6.0.9 |
Weakness: CWE-172 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
References
- https://vaadin.com/security/cve-2021-33604 x_refsource_CONFIRM
- https://github.com/vaadin/flow/pull/11099 x_refsource_CONFIRM