CVE-2021-33604

Published Jun 24, 2021

Last updated 3 years ago

Overview

Description
URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.
Source
security@vaadin.com
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Primary
Base score
2.5
Impact score
1.4
Exploitability score
1
Vector string
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Severity
LOW

CVSS 2.0

Type
Primary
Base score
1.2
Impact score
2.9
Exploitability score
1.9
Vector string
AV:L/AC:H/Au:N/C:P/I:N/A:N

Weaknesses

nvd@nist.gov
NVD-CWE-Other
security@vaadin.com
CWE-172

Social media

Hype score
Not currently trending

Configurations