CVE-2021-33604

Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19

State: Published
Severity: 2.5 Low
Published: Jun 24, 2021
Updated: Sep 17, 2024
Reserved: May 27, 2021

Description

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

Scores

CVSS	Score	Vector	Source
3.1	2.5 Low	CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N	Vaadin

Weaknesses

CWE-172 Encoding Error

Affected Products

Product	Versions
VaadinVaadin	14.0.0 to before unspecifiedAffected 14.6.1 and earlierAffected 15.0.0 to before unspecifiedAffected 19.0.8 and earlierAffected
flow-serverVaadin	2.0.0 to before unspecifiedAffected 2.6.1 and earlierAffected 3.0.0 to before unspecifiedAffected 6.0.9 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.