GHSA-3h5r-928v-mxhh

Suggest an improvement
Source
https://github.com/advisories/GHSA-3h5r-928v-mxhh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-3h5r-928v-mxhh/GHSA-3h5r-928v-mxhh.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-3h5r-928v-mxhh
Published
2021-04-19T14:49:13Z
Modified
2024-12-02T05:55:11.439626Z
Severity
  • 2.6 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
Details

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

  • https://vaadin.com/security/cve-2018-25007
Database specific 
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-754"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-16T23:14:45Z"
}
References

Affected packages

Maven / com.vaadin:vaadin-bom

Package

Name
com.vaadin:vaadin-bom
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin-bom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
10.0.0
Fixed
10.0.8

Affected versions

10.*

10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.0.6
10.0.7

Maven / com.vaadin:vaadin-bom

Package

Name
com.vaadin:vaadin-bom
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/vaadin-bom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
11.0.0
Fixed
11.0.3

Affected versions

11.*

11.0.0
11.0.1
11.0.2