GHSA-jmx8-355m-8vwh

Source

https://github.com/advisories/GHSA-jmx8-355m-8vwh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-jmx8-355m-8vwh/GHSA-jmx8-355m-8vwh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jmx8-355m-8vwh

Aliases

CVE-2018-25007

Published

2021-04-19T14:53:09Z

Modified

2023-11-08T04:00:14.726765Z

Severity

2.6 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

Details

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

https://vaadin.com/security/cve-2018-25007

Database specific

{
    "nvd_published_at": "2021-04-23T16:15:00Z",
    "github_reviewed_at": "2021-04-16T23:18:28Z",
    "severity": "LOW",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-754"
    ]
}

References

Affected packages

Maven / com.vaadin:flow-server

Package

Name: com.vaadin:flow-server; View open source insights on deps.dev
Purl: pkg:maven/com.vaadin/flow-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.0.0

Fixed

1.0.6

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

Database specific

{
    "last_known_affected_version_range": "<= 1.0.5"
}