CVE-2020-36321

Directory traversal in development mode handler in Vaadin 14 and 15-17

State: Published
Severity: 5.9 Medium
Published: Apr 23, 2021
Updated: Sep 17, 2024
Reserved: Apr 13, 2021

Description

Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	Vaadin

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
VaadinVaadin	14.0.0 and laterAffectedfrom 15.0.0Affectedfrom 18.0.0Not affected
flow-serverVaadin	2.0.0 and laterAffectedfrom 3.0.0Affectedfrom 5.0.0Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.