GHSA-rjww-2x8v-m9v9

Potential sensitive data exposure in applications using Vaadin 15

Source: GitHub Advisory Database (reviewed) Low CVE-2020-36319

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.vaadin:flow-server	>= 3.0.0, < 3.0.6	3.0.6

Details

As written in the advisory (Markdown source, shown as plain text).

Insecure configuration of default `ObjectMapper` in `com.vaadin:flow-server` versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. `@RestController` - https://vaadin.com/security/cve-2020-36319

References

External links from the advisory. They lead to third-party sites.

https://github.com/vaadin/flow/security/advisories/GHSA-rjww-2x8v-m9v9 web
https://nvd.nist.gov/vuln/detail/CVE-2020-36319 advisory
https://github.com/vaadin/flow/pull/8016 web
https://github.com/vaadin/flow/pull/8051 web
https://github.com/vaadin/flow package
https://vaadin.com/security/cve-2020-36319 web