GHSA-jmx8-355m-8vwhLowCVSS 2.6

Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

Published
April 19, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2018-25007 →

📋 Description

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

  • https://vaadin.com/security/cve-2018-25007

🎯 Affected products1

  • maven/com.vaadin:flow-server:>= 1.0.0, <= 1.0.5

🔗 References (5)