Description

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL

Remediation

References

https://github.com/vaadin/flow/pull/5498

https://vaadin.com/security/cve-2019-25027

Related Vulnerabilities

CVE-2018-20821 Vulnerability in npm package node-sass

CVE-2014-3604 Vulnerability in maven package ca.juliusdavies:not-yet-commons-ssl

CVE-2021-33813 Vulnerability in maven package org.jdom:jdom

CVE-2018-11787 Vulnerability in maven package org.apache.karaf.webconsole:org.apache.karaf.webconsole.features

CVE-2017-1000427 Vulnerability in maven package org.webjars.bower:marked

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Patch Third Party Advisory Vendor Advisory