Skip to content

Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

Low severity GitHub Reviewed Published Apr 16, 2021 in vaadin/platform • Updated Jan 9, 2023

Package

maven com.vaadin:vaadin-bom (Maven)

Affected versions

>= 10.0.0, < 10.0.8
>= 11.0.0, < 11.0.3

Patched versions

10.0.8
11.0.3

Description

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

References

@fluorumlabs fluorumlabs published to vaadin/platform Apr 16, 2021
Reviewed Apr 16, 2021
Published to the GitHub Advisory Database Apr 19, 2021
Last updated Jan 9, 2023

Severity

Low
2.6
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
High
Privileges required
Low
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-3h5r-928v-mxhh

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.