medium5.9
CVE-2020-36321
Directory traversal in development mode handler in Vaadin 14 and 15-17
Impact
Improper URL validation in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder. - https://vaadin.com/security/cve-2020-36321
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.vaadin:flow-server | >= 3.0.0, < 5.0.0 | 5.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vaadin | Flow | from 2.0.0 before 2.4.2 from 3.0.0 before 5.0.0 |
| Vaadin | Vaadin | from 14.0.0 before 14.4.3 from 15.0.0 before 18.0.0 |