Read the docs
TI-2021-12990 Aliases CVE-2021-33611GHSA-93c4-vf86-3rj7

Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL

Why it matters now

EPSS 0.00986 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed com.vaadin:vaadin-bom (Maven): 14.4.5org.webjars.bowergithub.vaadin:vaadin-menu-bar (Maven): 1.2.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
VaadinVaadin14.0.0 and later; up to 14.4.4—No fix listedCNA
Vaadinvaadin-menu-bar1.0.0 and later; up to 1.2.0—No fix listedCNA
—com.vaadin:vaadin-bom (Maven)14.0.0 to before 14.4.514.4.5Patch availableGHSA-93c4-vf86-3rj7
—org.webjars.bowergithub.vaadin:vaadin-menu-bar (Maven)1.0.0 to before 1.2.11.2.1Patch availableGHSA-93c4-vf86-3rj7
  • Vaadin VendorVaadin Affected 14.0.0 and later; up to 14.4.4 Fixed in — No fix listed CNA
  • vaadin-menu-bar VendorVaadin Affected 1.0.0 and later; up to 1.2.0 Fixed in — No fix listed CNA
  • com.vaadin:vaadin-bom (Maven) Vendor— Affected 14.0.0 to before 14.4.5 Fixed in 14.4.5 Patch available GHSA-93c4-vf86-3rj7
  • org.webjars.bowergithub.vaadin:vaadin-menu-bar (Maven) Vendor— Affected 1.0.0 to before 1.2.1 Fixed in 1.2.1 Patch available GHSA-93c4-vf86-3rj7

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*14.0.0 – 14.4.4VulnerableVaadin
cpe:2.3:a:vaadin:vaadin-menu-bar:*:*:*:*:*:*:*:*1.0.0 – 1.2.0VulnerableVaadin
  • cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 14.0.0 – 14.4.4 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin-menu-bar:*:*:*:*:*:*:*:* Versions 1.0.0 – 1.2.0 Vulnerable ·Vaadin

Remediation

  • Fix · GHSA-93c4-vf86-3rj7 com.vaadin:vaadin-bom (Maven) Fixed in 14.4.5 Advisory →
  • Fix · GHSA-93c4-vf86-3rj7 org.webjars.bowergithub.vaadin:vaadin-menu-bar (Maven) Fixed in 1.2.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-33611
  2. 2026-10-03 Alias added: GHSA-93c4-vf86-3rj7

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
  • TI-2020-18603 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 CVSS 3.1HIGH 7.5
  • TI-2021-11541 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVSS 3.1HIGH 7.5
  • TI-2022-12014 Possible information disclosure inside TreeGrid component with default data provider CVSS 3.1HIGH 7.5
  • TI-2021-11537 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
  • TI-2020-18604 Directory traversal in development mode handler in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences