Read the docs

Vaadin

Records35All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

Vaadin records in CISA KEV

No Vaadin vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Vaadin 24 records MEDIUM Flow 11 records MEDIUM Designer 1 record MEDIUM Flow-server 1 record LOW Vaadin-checkbox-flow 1 record LOW Vaadin-menu-bar 1 record LOW

Records

11 records in Flow · all components

TI-2021-11539 CVE-2021-31407 · GHSA-25xc-jwfq-39jw

Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19

Priority MEDIUM 42

Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.02382 Published 2021-04-23 Fixed in 2.4.8, 6.0.1 CWE-402
TI-2021-11537 CVE-2021-31405 · GHSA-2wqp-jmcc-mc77

Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17

Priority LOW 35

Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers t…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01127 Published 2021-04-23 Fixed in 14.4.4, 17.0.11 CWE-400
TI-2020-18604 CVE-2020-36321 · GHSA-49r2-73m6-pp8f

Directory traversal in development mode handler in Vaadin 14 and 15-17

Priority LOW 35

Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01211 Published 2021-04-23 Fixed in 5.0.0, 2.4.2 CWE-22
TI-2021-11543 CVE-2021-31411 · GHSA-p826-8vhq-h439

Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19

Priority LOW 34

Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00231 Published 2021-05-05 Fixed in 14.5.3, 19.0.5 CWE-379
TI-2021-11540 CVE-2021-31408 · GHSA-mr8h-j9cv-4m8h

Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19

Priority LOW 31

Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Sec…

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.00322 Published 2021-04-23 Fixed in 19.0.4 CWE-613
TI-2020-18602 CVE-2020-36319 · GHSA-rjww-2x8v-m9v9

Potential sensitive data exposure in applications using Vaadin 15

Priority LOW 31

Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01001 Published 2021-04-23 Fixed in 3.0.6 CWE-200
TI-2019-15167 CVE-2019-25027 · GHSA-rp4x-wxqv-cf9m

Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

Priority LOW 28

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attack…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00668 Published 2021-04-23 Fixed in 1.0.11, 1.4.3 CWE-81
TI-2021-11544 CVE-2021-31412 · GHSA-qrg9-f472-qwfm

Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19

Priority LOW 27

Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01318 Published 2021-06-24 Fixed in 10.0.19, 14.6.2 +1 CWE-1295
TI-2018-15234 CVE-2018-25007 · GHSA-jmx8-355m-8vwh

Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

Priority LOW 21

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchro…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00574 Published 2021-04-23 Fixed in 1.0.6 CWE-754
TI-2021-11538 CVE-2021-31406 · GHSA-p7jq-v8jp-j424

Timing side channel vulnerability in endpoint request handler in Vaadin 15-19

Priority LOW 18

Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0)…

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.00211 Published 2021-04-23 Fixed in 5.0.4, 6.0.1 CWE-208
TI-2021-11536 CVE-2021-31404 · GHSA-xwg3-qrcg-w9x6

Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18

Priority LOW 18

Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4…

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.0021 Published 2021-04-23 Fixed in 1.0.14, 2.4.7 +1 CWE-208
Open these records in search →