Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20
Priority LOW 21CWE-754Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled Checkbox inside enabled CheckboxGroup component via unspecified vectors.
Why it matters now
EPSS 0.00665 52nd percentileScored 2026-11-07
Fix Fixed com.vaadin:vaadin-checkbox-flow (Maven): 14.6.8, 20.0.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Vaadin | Vaadin | 12.0.0 and later; before 14.0.0; 14.0.0 and later; before 14.5.0; 15.0.0 and later; up to 17.0.11; 14.5.0 and later; up to 14.6.7; 18.0.0 and later; up to 20.0.5 | — | No fix listed | CNA |
| Vaadin | vaadin-checkbox-flow | 1.2.0 and later; before 2.0.0; 2.0.0 and later; before 3.0.0; 3.0.0 and later; up to 4.0.1; 14.5.0 and later; up to 14.6.7; 18.0.0 and later; up to 20.0.5 | — | No fix listed | CNA |
| — | com.vaadin:vaadin-checkbox-flow (Maven) | 12.0.0 to before 14.6.8 | 14.6.8 | Patch available | GHSA-qcc4-3rxf-gf4m |
| — | com.vaadin:vaadin-checkbox-flow (Maven) | 15.0.0 to before 20.0.6 | 20.0.6 | Patch available | GHSA-qcc4-3rxf-gf4m |
- Vaadin VendorVaadin Affected 12.0.0 and later; before 14.0.0; 14.0.0 and later; before 14.5.0; 15.0.0 and later; up to 17.0.11; 14.5.0 and later; up to 14.6.7; 18.0.0 and later; up to 20.0.5 Fixed in — No fix listed CNA
- vaadin-checkbox-flow VendorVaadin Affected 1.2.0 and later; before 2.0.0; 2.0.0 and later; before 3.0.0; 3.0.0 and later; up to 4.0.1; 14.5.0 and later; up to 14.6.7; 18.0.0 and later; up to 20.0.5 Fixed in — No fix listed CNA
- com.vaadin:vaadin-checkbox-flow (Maven) Vendor— Affected 12.0.0 to before 14.6.8 Fixed in 14.6.8 Patch available GHSA-qcc4-3rxf-gf4m
- com.vaadin:vaadin-checkbox-flow (Maven) Vendor— Affected 15.0.0 to before 20.0.6 Fixed in 20.0.6 Patch available GHSA-qcc4-3rxf-gf4m
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vaadin:vaadin-checkbox-flow:*:*:*:*:*:*:*:* | 1.2.0 to before 2.0.0 | Vulnerable | Vaadin |
| cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* | 12.0.0 to before 14.0.0 | Running on | Vaadin |
| cpe:2.3:a:vaadin:vaadin-checkbox-flow:*:*:*:*:*:*:*:* | 2.0.0 to before 3.0.0 | Vulnerable | Vaadin |
| cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* | 14.0.0 to before 14.5.0 | Running on | Vaadin |
| cpe:2.3:a:vaadin:vaadin-checkbox-flow:*:*:*:*:*:*:*:* | 3.0.0 to before 4.0.1 | Vulnerable | Vaadin |
| cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* | 15.0.0 to before 17.0.11 | Running on | Vaadin |
| cpe:2.3:a:vaadin:vaadin-checkbox-flow:*:*:*:*:*:*:*:* | 14.5.0 to before 14.6.7 | Vulnerable | Vaadin |
| cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* | 14.5.0 to before 14.6.7 | Running on | Vaadin |
| cpe:2.3:a:vaadin:vaadin-checkbox-flow:*:*:*:*:*:*:*:* | 18.0.0 to before 20.0.5 | Vulnerable | Vaadin |
| cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* | 18.0.0 to before 20.0.5 | Running on | Vaadin |
- cpe:2.3:a:vaadin:vaadin-checkbox-flow:*:*:*:*:*:*:*:* Versions 1.2.0 to before 2.0.0 Vulnerable ·Vaadin
- cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 12.0.0 to before 14.0.0 Running on ·Vaadin
- cpe:2.3:a:vaadin:vaadin-checkbox-flow:*:*:*:*:*:*:*:* Versions 2.0.0 to before 3.0.0 Vulnerable ·Vaadin
- cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 14.0.0 to before 14.5.0 Running on ·Vaadin
- cpe:2.3:a:vaadin:vaadin-checkbox-flow:*:*:*:*:*:*:*:* Versions 3.0.0 to before 4.0.1 Vulnerable ·Vaadin
- cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 15.0.0 to before 17.0.11 Running on ·Vaadin
- cpe:2.3:a:vaadin:vaadin-checkbox-flow:*:*:*:*:*:*:*:* Versions 14.5.0 to before 14.6.7 Vulnerable ·Vaadin
- cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 14.5.0 to before 14.6.7 Running on ·Vaadin
- cpe:2.3:a:vaadin:vaadin-checkbox-flow:*:*:*:*:*:*:*:* Versions 18.0.0 to before 20.0.5 Vulnerable ·Vaadin
- cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 18.0.0 to before 20.0.5 Running on ·Vaadin
Remediation
- Fix · GHSA-qcc4-3rxf-gf4m com.vaadin:vaadin-checkbox-flow (Maven) Fixed in 14.6.8 Advisory →
- Fix · GHSA-qcc4-3rxf-gf4m com.vaadin:vaadin-checkbox-flow (Maven) Fixed in 20.0.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-33605
- 2026-10-03 Alias added: GHSA-qcc4-3rxf-gf4m
References
Other 4
- https://github.com/vaadin/flow-components/security/advisories/GHSA-qcc4-3rxf-gf4m
- https://github.com/vaadin/flow-components/commit/1aa6bc94c763023bc3fc5849c2a1e8cab3bf6766
- https://github.com/vaadin/flow-components/commit/f136532a735f703f1144f19fee48c9009c659f03
- https://github.com/vaadin/flow-components
Sources
- CVE-2021-33605 · CVE Program
- CVE-2021-33605 · NVD
- FIRST EPSS
- GHSA-qcc4-3rxf-gf4m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences