Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
Package
Affected versions
>= 1.0.0, < 1.0.15
>= 1.1.0, < 2.6.2
>= 3.0.0, < 6.0.10
Patched versions
1.0.15
2.6.2
6.0.10
Description
Reviewed
Oct 13, 2021
Published to the GitHub Advisory Database
Oct 13, 2021
Last updated
Jan 9, 2023
Improper sanitization of path in default
RouteNotFoundError
view incom.vaadin:flow-server
versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler forNotFoundException
is provided.References