Read the docs
TI-2021-22710 Aliases GHSA-hw7r-qrhp-5pff

Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

Improper check in `CheckboxGroup` in `com.vaadin:vaadin-checkbox-flow` versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled `Checkbox` inside enabled `CheckboxGroup` component via unspecified vectors. - https://vaadin.com/security/cve-2021-33605

Why it matters now

Fix Fixed com.vaadin:vaadin-bom (Maven): 14.6.8, 20.0.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—com.vaadin:vaadin-bom (Maven)12.0.0 to before 14.6.814.6.8Patch availableGHSA-hw7r-qrhp-5pff
—com.vaadin:vaadin-bom (Maven)15.0.0 to before 20.0.620.0.6Patch availableGHSA-hw7r-qrhp-5pff
  • com.vaadin:vaadin-bom (Maven) Vendor— Affected 12.0.0 to before 14.6.8 Fixed in 14.6.8 Patch available GHSA-hw7r-qrhp-5pff
  • com.vaadin:vaadin-bom (Maven) Vendor— Affected 15.0.0 to before 20.0.6 Fixed in 20.0.6 Patch available GHSA-hw7r-qrhp-5pff

Remediation

  • Fix · GHSA-hw7r-qrhp-5pff com.vaadin:vaadin-bom (Maven) Fixed in 14.6.8 Advisory →
  • Fix · GHSA-hw7r-qrhp-5pff com.vaadin:vaadin-bom (Maven) Fixed in 20.0.6 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-hw7r-qrhp-5pff

References

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences