CVE-2021-33605

Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20

State: Published
Severity: 4.3 Medium
Published: Aug 25, 2021
Updated: Sep 17, 2024
Reserved: May 27, 2021

Description

Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled Checkbox inside enabled CheckboxGroup component via unspecified vectors.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	Vaadin

Weaknesses

CWE-754 Improper Check for Unusual or Exceptional Conditions

Affected Products

Product	Versions
VaadinVaadin	12.0.0 to before unspecifiedAffected before 14.0.0Affected 14.0.0 to before unspecifiedAffected before 14.5.0Affected 15.0.0 to before unspecifiedAffected 17.0.11 and earlierAffected 14.5.0 to before unspecifiedAffected 14.6.7 and earlierAffected 18.0.0 to before unspecifiedAffected 20.0.5 and earlierAffected
vaadin-checkbox-flowVaadin	1.2.0 to before unspecifiedAffected before 2.0.0Affected 2.0.0 to before unspecifiedAffected before 3.0.0Affected 3.0.0 to before unspecifiedAffected 4.0.1 and earlierAffected 14.5.0 to before unspecifiedAffected 14.6.7 and earlierAffected 18.0.0 to before unspecifiedAffected 20.0.5 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.