GHSA-93c4-vf86-3rj7
Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.vaadin:vaadin-bom | >= 14.0.0, < 14.4.5 | 14.4.5 |
| Maven | org.webjars.bowergithub.vaadin:vaadin-menu-bar | >= 1.0.0, < 1.2.1 | 1.2.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Missing output sanitization in test sources in `org.webjars.bowergithub.vaadin:vaadin-menu-bar` versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL.
References
External links from the advisory. They lead to third-party sites.