Description
Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder.
Remediation
References
https://vaadin.com/security/cve-2020-36321
https://github.com/vaadin/flow/pull/9392
Related Vulnerabilities
CVE-2020-6428 Vulnerability in maven package org.webjars.npm:electron
CVE-2016-0714 Vulnerability in maven package org.apache.tomcat:tomcat-util
CVE-2020-7009 Vulnerability in maven package org.elasticsearch:elasticsearch
CVE-2016-5016 Vulnerability in maven package org.cloudfoundry.identity:cloudfoundry-identity-common
CVE-2023-24448 Vulnerability in maven package org.jenkins-ci.plugins:rabbitmq-consumer