What is GHSA-jqj4-r483-4gvr?

GHSA-jqj4-r483-4gvr is a security advisory published by GitHub Security Advisories with Medium severity. Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

Why does GHSA-jqj4-r483-4gvr have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-jqj4-r483-4gvr?

GHSA-jqj4-r483-4gvr has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-jqj4-r483-4gvr?

GHSA-jqj4-r483-4gvr affects 2 products, including: maven/com.vaadin:vaadin-bom:\u003e= 10.0.0, \u003c 10.0.14; maven/com.vaadin:vaadin-bom:\u003e= 11.0.0, \u003c 13.0.6.

GHSA-jqj4-r483-4gvrMediumCVSS 6.1Disclosed before NVD

Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

Vendor

GitHub Security Advisories

Published

April 19, 2021

Last Modified

January 9, 2023

📋 Description

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL.

https://vaadin.com/security/cve-2019-25027

🎯 Affected products2

maven/com.vaadin:vaadin-bom:>= 10.0.0, < 10.0.14
maven/com.vaadin:vaadin-bom:>= 11.0.0, < 13.0.6

🔗 References (3)

https://github.com/vaadin/platform/security/advisories/GHSA-jqj4-r483-4gvr
https://vaadin.com/security/cve-2019-25027
https://github.com/advisories/GHSA-jqj4-r483-4gvr