CVE-2021-33604

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-33604

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33604.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-33604

Aliases

GHSA-c99r-67x4-whj6

Published

2021-06-24T12:15:08.157Z

Modified

2026-07-26T05:54:18.816754Z

Severity

2.5 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator

Summary

[none]

Details

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

References

Affected packages

Git / github.com/vaadin/flow

Affected ranges

Type

GIT

Repo

https://github.com/vaadin/flow

Events

Introduced

8e306579f157678c3baa3f3f63f406d073668161

Last affected

028ba87748c990948f44fe47c6b680c8b5e197d2

Introduced

4b6ca4330163c4e976b32d03880fe2154a9d1ca7

Last affected

60b4fd8e59948e2a6a5f8af1988a3adc45563ffc

Introduced

6a409a8b4b01b18dc2ca30c59395aeeb0cffbd2c

Last affected

9ebb07ae013fd667dec105c9cde3aaf9acc23e81

Database specific

{
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.6.1"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "5.0.0"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "last_affected": "6.0.9"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:vaadin:flow-server:*:*:*:*:*:*:*:*"
}

Affected versions

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.1.0.alpha1

2.1.0.beta1

2.1.0.beta3

2.2.0.alpha1

2.2.0.alpha10

2.2.0.alpha11

2.2.0.alpha12

2.2.0.alpha13

2.2.0.alpha14

2.2.0.alpha15

2.2.0.alpha16

2.2.0.alpha2

2.2.0.alpha3

2.2.0.alpha4

2.2.0.alpha5

2.2.0.alpha6

2.2.0.alpha7

2.2.0.alpha8

2.2.0.alpha9

2.2.0.beta1

2.2.0.beta2

2.2.0.rc1

2.2.alpha14

2.3.0

2.3.0.alpha1

2.3.0.beta1

2.3.0.beta2

2.3.0.beta3

2.3.1

2.3.2

2.3.3

2.3.4

2.4.0

2.4.0.alpha1

2.4.0.beta1

2.4.0.beta2

2.5.0.alpha1

2.5.0.alpha2

2.6.0

2.6.0.alpha1

2.6.0.beta1

2.6.0.beta2

2.6.0.rc1

2.6.1

3.*

3.0.0.alpha17

3.0.0.alpha5

3.0.0.beta1

3.0.0.beta2

3.0.0.beta3

3.0.0.beta4

3.2.0.alpha1

3.2.0.alpha2

3.2.0.alpha3

3.2.0.alpha4

3.2.0.alpha5

3.2.0.alpha6

3.2.0.alpha7

4.*

4.0.0.alpha1

4.0.0.alpha2

4.0.0.alpha3

4.0.0.beta1

5.*

5.0.0

5.0.0.alpha1

5.0.0.beta1

5.0.0.rc1

6.*

6.0.0

6.0.0.rc1

6.0.1

6.0.2

6.0.3

6.0.4

6.0.5

6.0.6

6.0.7

6.0.8

6.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33604.json"

Git / github.com/vaadin/platform

Affected ranges

Type

GIT

Repo

https://github.com/vaadin/platform

Events

Introduced

1497812ad40b7ff90bef8bdb28808afc8d7194d1

Last affected

18d5f285f900b35a26b53d3b99c19ebf38aa7f24

Introduced

354ad0186b5e61b548adad84de03af297dc6f2a6

Last affected

0f6048aefc10582e3042adb05064dac232f2f2c9

Introduced

5c28d4e1b9099122cf4d770283777f00a960aab3

Last affected

75f1480f498fae93a7ba1d909e0fe4d45ea31fc6

Database specific

{
    "extracted_events": [
        {
            "introduced": "14.0.0"
        },
        {
            "last_affected": "14.6.1"
        },
        {
            "introduced": "15.0.0"
        },
        {
            "last_affected": "18.0.0"
        },
        {
            "introduced": "19.0.0"
        },
        {
            "last_affected": "19.0.8"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*"
}

Affected versions

14.*

14.0.0

14.0.1

14.0.2

14.1.0

14.1.0.alpha1

14.1.0.alpha3

14.1.0.beta1

14.1.0.beta2

14.1.1

14.1.2

14.2.0

14.2.0.alpha1

14.2.0.alpha10

14.2.0.alpha11

14.2.0.alpha2

14.2.0.alpha3

14.2.0.alpha4

14.2.0.alpha5

14.2.0.alpha6

14.2.0.alpha7

14.2.0.alpha8

14.2.0.alpha9

14.2.0.beta1

14.2.0.rc1

14.3.0

14.3.0.alpha1

14.3.0.beta1

14.3.0.beta2

14.3.0.beta3

14.3.0.rc1

14.4.0

14.4.0.alpha1

14.4.0.beta1

14.4.0.beta2

14.4.0.rc1

14.5.0.alpha1

14.5.0.alpha2

14.5.0.alpha3

14.5.0.beta1

14.5.0.rc1

14.6.0

14.6.0.alpha1

14.6.0.alpha2

14.6.0.beta1

14.6.0.beta2

14.6.0.rc1

14.6.1

15.*

15.0.0

15.0.0.rc1

16.*

16.0.0.alpha1

16.0.0.alpha2

16.0.0.alpha3

16.0.1

17.*

17.0.0

17.0.0.alpha2

17.0.0.alpha3

17.0.0.alpha4

17.0.0.alpha5

17.0.0.alpha6

17.0.0.alpha7

17.0.0.beta1

17.0.0.beta2

17.0.0.beta3

17.0.0.rc1

17.0.0.rc2

18.*

18.0.0

18.0.0.alpha1

18.0.0.beta1

18.0.0.beta2

18.0.0.beta3

18.0.0.rc1

18.0.0.rc2

19.*

19.0.0

19.0.1

19.0.2

19.0.3

19.0.4

19.0.5

19.0.6

19.0.7

19.0.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33604.json"

Git / github.com/vaadin/vaadin

Affected ranges

Type

GIT

Repo

https://github.com/vaadin/vaadin

Events

Introduced

ca9cf99092245a31a84b317adf1d79a397970d27

Last affected

e19775cf4b00eb14e98acd9b0452642c2a7010ff

Introduced

9efda1b1e0a27769eef9292dd7799d8fea77e633

Last affected

a5bc6b4832e649fb16243e2bc0ee9b2941815e3b

Introduced

3981409421683b6f4a796f37b67433d36b6a7ca1

Last affected

b41a52e3d8a4d4e90726e15cba6e2ae31b4722ba

Database specific

{
    "extracted_events": [
        {
            "introduced": "14.0.0"
        },
        {
            "last_affected": "14.6.1"
        },
        {
            "introduced": "15.0.0"
        },
        {
            "last_affected": "18.0.0"
        },
        {
            "introduced": "19.0.0"
        },
        {
            "last_affected": "19.0.8"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*"
}

Affected versions

v14.*

v14.0.0

v14.0.1

v14.0.2

v14.1.0

v14.1.0-alpha1

v14.1.0-alpha2

v14.1.0-alpha3

v14.1.0-alpha4

v14.1.0-alpha5

v14.1.0-beta1

v14.1.0-beta2

v14.1.0-beta3

v14.1.0-rc1

v14.1.1

v14.1.2

v14.2.0

v14.2.0-alpha1

v14.2.0-alpha10

v14.2.0-alpha11

v14.2.0-alpha2

v14.2.0-alpha3

v14.2.0-alpha4

v14.2.0-alpha5

v14.2.0-alpha6

v14.2.0-alpha7

v14.2.0-alpha8

v14.2.0-alpha9

v14.2.0-beta1

v14.2.0-rc1

v14.3.0

v14.3.0-alpha1

v14.3.0-beta1

v14.3.0-beta2

v14.3.0-beta3

v14.3.0-rc1

v14.4.0

v14.4.0-alpha1

v14.4.0-beta1

v14.4.0-beta2

v14.4.0-rc1

v14.5.0-alpha1

v14.5.0-alpha2

v14.5.0-alpha3

v14.5.0-beta1

v14.5.0-rc1

v14.6.0

v14.6.0-alpha1

v14.6.0-alpha2

v14.6.0-beta1

v14.6.0-beta2

v14.6.0-rc1

v14.6.1

v15.*

v15.0.0-alpha1

v15.0.0-alpha10

v15.0.0-alpha11

v15.0.0-alpha12

v15.0.0-alpha13

v15.0.0-alpha14

v15.0.0-alpha15

v15.0.0-alpha2

v15.0.0-alpha3

v15.0.0-alpha4

v15.0.0-alpha5

v15.0.0-alpha6

v15.0.0-alpha7

v15.0.0-alpha8

v15.0.0-alpha9

v15.0.0-beta1

v15.0.0-beta2

v15.0.0-beta3

v15.0.0-beta4

v15.0.0-beta5

v15.0.0-rc1

v16.*

v16.0.0-alpha1

v16.0.0-alpha2

v16.0.0-alpha3

v17.*

v17.0.0

v17.0.0-alpha1

v17.0.0-alpha2

v17.0.0-alpha3

v17.0.0-alpha4

v17.0.0-alpha5

v17.0.0-alpha6

v17.0.0-alpha7

v17.0.0-beta1

v17.0.0-beta2

v17.0.0-beta3

v17.0.0-rc1

v17.0.0-rc2

v18.*

v18.0.0

v18.0.0-alpha1

v18.0.0-beta1

v18.0.0-beta2

v18.0.0-beta3

v18.0.0-rc1

v18.0.0-rc2

v19.*

v19.0.0

v19.0.1

v19.0.2

v19.0.3

v19.0.4

v19.0.5

v19.0.6

v19.0.7

v19.0.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33604.json"