HIGH🇵🇱 Wersja polska

CVE-2021-31407

CVSS 8.6v3.1pub. 2021-04-23upd. 2024-11-21

Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

  • Vaadin Flow

    APP
    Vaadin
    1.2.0 – 2.4.8 (excl.)6.0.0 – 6.0.2 (excl.)

  • Vaadin

    APP
    Vaadin
    19.0.012.0.0 – 14.4.10 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2021-31409HIGH7.5same product

Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 t...

CVE-2020-36320HIGH7.5same product

Unsafe validation RegEx in EmailValidator class in com.vaadin:vaadin-server versions 7.0.0 through 7.7.21 (Vaa...

CVE-2021-31405HIGH7.5same product

Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2....

CVE-2026-2742MEDIUM5.3same product

W Vaadin 14.0.0 do 14.14.0, 23.0.0 do 23.6.6, 24.0.0 do 24.9.7 oraz 25.0.0 do 25.0.1 istnieje luka authenticat...

CVE-2023-25499MEDIUM5.7same product

When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 t...