high8.6
CVE-2021-31407
OSGi applications using Vaadin 12-14 and 19 vulnerable to server classes and resources exposure
Impact
Vulnerability in OSGi integration in `com.vaadin:flow-server` versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request. - https://vaadin.com/security/cve-2021-31407
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.vaadin:flow-server | = 6.0.0 | 6.0.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vaadin | Flow | from 1.2.0 before 2.4.8 from 6.0.0 before 6.0.2 |
| Vaadin | Vaadin | from 12.0.0 before 14.4.10 Version 19.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/vaadin/flow/pull/10229
- https://github.com/vaadin/flow/pull/10269
- https://github.com/vaadin/osgi/issues/50
- https://vaadin.com/security/cve-2021-31407
- https://github.com/advisories/GHSA-25xc-jwfq-39jw
- https://github.com/vaadin/flow/security/advisories/GHSA-25xc-jwfq-39jw
- https://nvd.nist.gov/vuln/detail/CVE-2021-31407