GHSA-8vfw-v2jv-9hwc

Suggest an improvement
Source
https://github.com/advisories/GHSA-8vfw-v2jv-9hwc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-8vfw-v2jv-9hwc/GHSA-8vfw-v2jv-9hwc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8vfw-v2jv-9hwc
Published
2021-06-28T16:52:45Z
Modified
2024-12-02T05:41:34Z
Severity
  • 2.5 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Reflected cross-site scripting in development mode handler in Vaadin
Details

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

Database specific 
{
    "cwe_ids": [
        "CWE-172"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-06-24T19:39:30Z",
    "nvd_published_at": null,
    "severity": "LOW"
}
References

Affected packages

Maven / com.vaadin:flow-server

Package

Name
com.vaadin:flow-server
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/flow-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.6.2

Affected versions

2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.1.0.beta2
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0.alpha11
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0.beta1
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.4.9
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1

Database specific

last_known_affected_version_range 
"<= 2.6.1"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-8vfw-v2jv-9hwc/GHSA-8vfw-v2jv-9hwc.json"

Maven / com.vaadin:flow-server

Package

Name
com.vaadin:flow-server
View open source insights on deps.dev
Purl
pkg:maven/com.vaadin/flow-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
6.0.10

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0
3.1.1
3.1.2
3.1.3
3.1.5
3.1.6
3.1.7
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
6.*
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9

Database specific

last_known_affected_version_range 
"<= 6.0.9"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-8vfw-v2jv-9hwc/GHSA-8vfw-v2jv-9hwc.json"