Stored cross-site scripting in Grid component in Vaadin 7 and 8

Moderate

fluorumlabs published GHSA-q74r-4xw3-ppx9

Apr 16, 2021

Package

com.vaadin:vaadin-bom, com.vaadin:vaadin-server (Maven)

Affected versions

>=7.4.0, <=7.7.19, >=8.0.0, <=8.8.4

Patched versions

7.7.20, 8.8.5

Description

Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector.

https://vaadin.com/security/cve-2019-25028

Severity

Moderate

5.4

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N