Read the docs
TI-2020-18602 Aliases CVE-2020-36319GHSA-rjww-2x8v-m9v9

Potential sensitive data exposure in applications using Vaadin 15

Priority LOW 31CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. @RestController

Why it matters now

EPSS 0.01001 63rd percentileScored 2026-11-07
Fix Fixed com.vaadin:flow-server (Maven): 3.0.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
VaadinVaadin15.0.0 and later—No fix listedCNA
Vaadinflow-server3.0.0 and later—No fix listedCNA
—com.vaadin:flow-server (Maven)3.0.0 to before 3.0.63.0.6Patch availableGHSA-rjww-2x8v-m9v9
  • Vaadin VendorVaadin Affected 15.0.0 and later Fixed in — No fix listed CNA
  • flow-server VendorVaadin Affected 3.0.0 and later Fixed in — No fix listed CNA
  • com.vaadin:flow-server (Maven) Vendor— Affected 3.0.0 to before 3.0.6 Fixed in 3.0.6 Patch available GHSA-rjww-2x8v-m9v9

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*3.0.0 to before 3.0.6VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*15.0.0 to before 15.0.5VulnerableVaadin
  • cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.0.6 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 15.0.0 to before 15.0.5 Vulnerable ·Vaadin

Remediation

  • Fix · GHSA-rjww-2x8v-m9v9 com.vaadin:flow-server (Maven) Fixed in 3.0.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-36319
  2. 2026-10-03 Alias added: GHSA-rjww-2x8v-m9v9

References

Patch 2

Advisory 2

Other 2

  • TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
  • TI-2021-11537 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
  • TI-2020-18604 Directory traversal in development mode handler in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
  • TI-2021-11543 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 CVSS 3.1HIGH 7.8
  • TI-2021-11540 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVSS 3.1HIGH 7.1
  • TI-2019-15167 Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 CVSS 3.1MEDIUM 6.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences