What is GHSA-c99r-67x4-whj6?

GHSA-c99r-67x4-whj6 is a security advisory published by GitHub Security Advisories with Low severity. Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19

Which CVE IDs does GHSA-c99r-67x4-whj6 cover?

GHSA-c99r-67x4-whj6 covers the following CVE IDs: CVE-2021-33604. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c99r-67x4-whj6?

GHSA-c99r-67x4-whj6 has a CVSS v3 base score of 2.5, published by GitHub Security Advisories.

Which products are affected by GHSA-c99r-67x4-whj6?

GHSA-c99r-67x4-whj6 affects 2 products, including: maven/com.vaadin:vaadin-bom:\u003e= 14.0.0, \u003c= 14.6.1; maven/com.vaadin:vaadin-bom:\u003e= 15.0.0, \u003c= 19.0.8.

GHSA-c99r-67x4-whj6LowCVSS 2.5

Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19

Vendor

GitHub Security Advisories

Published

June 28, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-33604 →

📋 Description

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

https://vaadin.com/security/cve-2021-33604

🎯 Affected products2

maven/com.vaadin:vaadin-bom:>= 14.0.0, <= 14.6.1
maven/com.vaadin:vaadin-bom:>= 15.0.0, <= 19.0.8

🔗 References (5)

https://github.com/vaadin/platform/security/advisories/GHSA-c99r-67x4-whj6
https://nvd.nist.gov/vuln/detail/CVE-2021-33604
https://github.com/vaadin/flow/pull/11099
https://vaadin.com/security/cve-2021-33604
https://github.com/advisories/GHSA-c99r-67x4-whj6