This web application is running with the Vaadin Framework which is prone to cross-site scripting because the application fails to properly sanitize user-supplied input.

This could potentially, in certain situations, allow a malicious user to inject content, such as javascript, in order to perform a cross-site scripting (XSS) attack.

Upgrade to Vaadin Framework version 6.8.14 or later For updates refer to http://www.vaadin.com/releases

Proper escaping of the src-attribute on the client side was not ensured when using icons for OptionGroup items.

Vaadin Framework versions from 6.0.0 up to 6.8.13

Check the version.

• http://www.vaadin.com/download/release/6.8/6.8.14/release-notes.html

---

Updated on 2015-03-25