MEDIUM🇵🇱 Wersja polska

CVE-2019-25027

CVSS 6.1v3.1pub. 2021-04-23upd. 2024-11-21

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

  • Vaadin Flow

    APP
    Vaadin
    1.0.0 – 1.0.11 (excl.)1.1.0 – 1.4.3 (excl.)

  • Vaadin

    APP
    Vaadin
    10.0.0 – 10.0.14 (excl.)11.0.0 – 13.0.6 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2021-31409HIGH7.5same product

Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 t...

CVE-2021-31407HIGH8.6same product

Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 throug...

CVE-2021-31405HIGH7.5same product

Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2....

CVE-2020-36320HIGH7.5same product

Unsafe validation RegEx in EmailValidator class in com.vaadin:vaadin-server versions 7.0.0 through 7.7.21 (Vaa...

CVE-2026-2742MEDIUM5.3same product

W Vaadin 14.0.0 do 14.14.0, 23.0.0 do 23.6.6, 24.0.0 do 24.9.7 oraz 25.0.0 do 25.0.1 istnieje luka authenticat...