What is GHSA-3h5r-928v-mxhh?

GHSA-3h5r-928v-mxhh is a security advisory published by GitHub Security Advisories with Low severity. Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

Why does GHSA-3h5r-928v-mxhh have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-3h5r-928v-mxhh?

GHSA-3h5r-928v-mxhh has a CVSS v3 base score of 2.6, published by GitHub Security Advisories.

Which products are affected by GHSA-3h5r-928v-mxhh?

GHSA-3h5r-928v-mxhh affects 2 products, including: maven/com.vaadin:vaadin-bom:\u003e= 10.0.0, \u003c 10.0.8; maven/com.vaadin:vaadin-bom:\u003e= 11.0.0, \u003c 11.0.3.

GHSA-3h5r-928v-mxhhLowCVSS 2.6Disclosed before NVD

Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

Vendor

GitHub Security Advisories

Published

April 19, 2021

Last Modified

January 9, 2023

📋 Description

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

https://vaadin.com/security/cve-2018-25007

🎯 Affected products2

maven/com.vaadin:vaadin-bom:>= 10.0.0, < 10.0.8
maven/com.vaadin:vaadin-bom:>= 11.0.0, < 11.0.3

🔗 References (3)

https://github.com/vaadin/platform/security/advisories/GHSA-3h5r-928v-mxhh
https://vaadin.com/security/cve-2018-25007
https://github.com/advisories/GHSA-3h5r-928v-mxhh