Moderate severityNVD Advisory· Published Apr 23, 2021· Updated Sep 17, 2024
Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
CVE-2019-25027
Description
Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.vaadin:flow-serverMaven | >= 1.0.0, < 1.0.11 | 1.0.11 |
com.vaadin:flow-serverMaven | >= 1.1.0, < 1.4.3 | 1.4.3 |
Affected products
2- Vaadin/flow-serverv5Range: 1.0.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- github.com/advisories/GHSA-rp4x-wxqv-cf9mghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-25027ghsaADVISORY
- github.com/vaadin/flow/pull/5498ghsax_refsource_MISCWEB
- github.com/vaadin/flow/security/advisories/GHSA-rp4x-wxqv-cf9mghsaWEB
- vaadin.com/security/cve-2019-25027ghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.