vaadin flow vulnerabilities

Latest vaadin flow CVEs

Newest publication first

1. CVE-2021-31412 Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19

   Published 2021-06-24

   Medium·CVSS 5.3 EPSS 1.3%

   Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaa...

2. CVE-2021-31411 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19

   Published 2021-05-05

   High·CVSS 7.8 EPSS 0.23%

   Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to...

3. CVE-2021-31408 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19

   Published 2021-04-23

   High·CVSS 7.1 EPSS 0.32%

   Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusi...

4. CVE-2021-31404 Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18

   Published 2021-04-23

   Low·CVSS 2.5 EPSS 0.23%

   Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaa...

5. CVE-2021-31406 Timing side channel vulnerability in endpoint request handler in Vaadin 15-19

   Published 2021-04-23

   Low·CVSS 2.5 EPSS 0.23%

   Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoin...

6. CVE-2021-31405 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17

   Published 2021-04-23

   High·CVSS 7.5 EPSS 1.1%

   Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting mali...

7. CVE-2021-31407 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19

   Published 2021-04-23

   High·CVSS 7.5 EPSS 2.4%

   Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.

8. CVE-2019-25027 Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

   Published 2021-04-23

   Medium·CVSS 6.1 EPSS 0.67%

   Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL

9. CVE-2020-36321 Directory traversal in development mode handler in Vaadin 14 and 15-17

   Published 2021-04-23

   High·CVSS 7.5 EPSS 1.2%

   Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder.

10. CVE-2018-25007 Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

    Published 2021-04-23

    Medium·CVSS 4.3 EPSS 0.57%

    Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

11. CVE-2020-36319 Potential sensitive data exposure in applications using Vaadin 15

    Published 2021-04-23

    Medium·CVSS 6.5 EPSS 1.0%

    Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. @RestController

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.