GHSA-rp4x-wxqv-cf9mMediumCVSS 6.1

Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

Published
April 19, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2019-25027 →

📋 Description

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL.

  • https://vaadin.com/security/cve-2019-25027

🎯 Affected products2

  • maven/com.vaadin:flow-server:>= 1.0.0, < 1.0.11
  • maven/com.vaadin:flow-server:>= 1.1.0, < 1.4.3

🔗 References (5)