GHSA-rp4x-wxqv-cf9m

Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-25027

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.vaadin:flow-server	>= 1.0.0, < 1.0.11	1.0.11
Maven	com.vaadin:flow-server	>= 1.1.0, < 1.4.3	1.4.3

Details

As written in the advisory (Markdown source, shown as plain text).

Missing output sanitization in default `RouteNotFoundError` view in `com.vaadin:flow-server` versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL. - https://vaadin.com/security/cve-2019-25027

References

External links from the advisory. They lead to third-party sites.

https://github.com/vaadin/flow/security/advisories/GHSA-rp4x-wxqv-cf9m web
https://nvd.nist.gov/vuln/detail/CVE-2019-25027 advisory
https://github.com/vaadin/flow/pull/5498 web
https://vaadin.com/security/cve-2019-25027 web