GHSA-25xc-jwfq-39jw
OSGi applications using Vaadin 12-14 and 19 vulnerable to server classes and resources exposure
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.vaadin:flow-server | >= 1.2.0, < 2.4.8 | 2.4.8 |
| Maven | com.vaadin:flow-server | >= 6.0.0, < 6.0.1 | 6.0.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Vulnerability in OSGi integration in `com.vaadin:flow-server` versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.
- https://vaadin.com/security/cve-2021-31407
References
External links from the advisory. They lead to third-party sites.
- https://github.com/vaadin/flow/security/advisories/GHSA-25xc-jwfq-39jw
- https://nvd.nist.gov/vuln/detail/CVE-2021-31407
- https://github.com/vaadin/osgi/issues/50
- https://github.com/vaadin/flow/pull/10229
- https://github.com/vaadin/flow/pull/10269
- https://github.com/vaadin/flow
- https://vaadin.com/security/cve-2021-31407