GHSA-q74r-4xw3-ppx9

Stored cross-site scripting in Grid component in Vaadin 7 and 8

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-25028

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.vaadin:vaadin-bom	>= 7.4.0, < 7.7.20	7.7.20
Maven	com.vaadin:vaadin-bom	>= 8.0.0, < 8.8.5	8.8.5
Maven	com.vaadin:vaadin-server	>= 7.4.0, < 7.7.20	7.7.20
Maven	com.vaadin:vaadin-server	>= 8.0.0, < 8.8.5	8.8.5

Details

As written in the advisory (Markdown source, shown as plain text).

Missing variable sanitization in `Grid` component in `com.vaadin:vaadin-server` versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector. - https://vaadin.com/security/cve-2019-25028

References

External links from the advisory. They lead to third-party sites.

https://github.com/vaadin/framework/security/advisories/GHSA-q74r-4xw3-ppx9 web
https://nvd.nist.gov/vuln/detail/CVE-2019-25028 advisory
https://github.com/vaadin/framework/pull/11644 web
https://github.com/vaadin/framework/pull/11645 web
https://vaadin.com/security/cve-2019-25028 web