CVE-2021-33611

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-33611
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33611.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-33611
Aliases
Published
2021-11-02T10:15:07.683Z
Modified
2026-07-08T05:57:18.305058917Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL

References

Affected packages

Git / github.com/vaadin/vaadin

Affected ranges

Type
GIT
Repo
https://github.com/vaadin/vaadin
Events
Introduced
ca9cf99092245a31a84b317adf1d79a397970d27
Fixed
3411feab4bba930a1b2f0e2067d749708e652359
Database specific 
{
    "source": "DESCRIPTION",
    "extracted_events": [
        {
            "introduced": "14.0.0"
        },
        {
            "fixed": "14.4.4"
        }
    ]
}

Affected versions

v14.*
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.0-alpha1
v14.1.0-alpha2
v14.1.0-alpha3
v14.1.0-alpha4
v14.1.0-alpha5
v14.1.0-beta1
v14.1.0-beta2
v14.1.0-beta3
v14.1.0-rc1
v14.1.1
v14.1.2
v14.2.0
v14.2.0-alpha1
v14.2.0-alpha10
v14.2.0-alpha11
v14.2.0-alpha2
v14.2.0-alpha3
v14.2.0-alpha4
v14.2.0-alpha5
v14.2.0-alpha6
v14.2.0-alpha7
v14.2.0-alpha8
v14.2.0-alpha9
v14.2.0-beta1
v14.2.0-rc1
v14.3.0
v14.3.0-alpha1
v14.3.0-beta1
v14.3.0-beta2
v14.3.0-beta3
v14.3.0-rc1
v14.4.0
v14.4.0-alpha1
v14.4.0-beta1
v14.4.0-beta2
v14.4.0-rc1
v14.4.1
v14.4.2
v14.4.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33611.json"

Git / github.com/vaadin/vaadin-menu-bar

Affected ranges

Type
GIT
Repo
https://github.com/vaadin/vaadin-menu-bar
Events
Introduced
07891345ef8f413ae49317d1241ac3e4b095a3d6
Fixed
efb92bb0fdd7b78182b133c134c4e38063220e70
Database specific 
{
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "1.2.0"
        }
    ],
    "source": "DESCRIPTION"
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.1.0
v1.1.0-alpha1
v1.1.0-alpha2
v1.2.0-alpha1
v1.2.0-beta1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33611.json"