medium6.1
CVE-2021-33611
Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14
Impact
Missing output sanitization in test sources in `org.webjars.bowergithub.vaadin:vaadin-menu-bar` versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.vaadin:vaadin-bom | >= 14.0.0, <= 14.4.4 | 14.4.5 |
| maven | org.webjars.bowergithub.vaadin:vaadin-menu-bar | >= 1.0.0, <= 1.2.0 | 1.2.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vaadin | Vaadin | from 14.0.0 through 14.4.4 |
| Vaadin | Vaadin-Menu-Bar | from 1.0.0 through 1.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/vaadin/vaadin-menu-bar/pull/126
- https://vaadin.com/security/cve-2021-33611
- https://github.com/advisories/GHSA-93c4-vf86-3rj7
- https://github.com/vaadin/platform/security/advisories/GHSA-93c4-vf86-3rj7
- https://nvd.nist.gov/vuln/detail/CVE-2021-33611