← CVE Intelligence

CVE-2018-25007

Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11 PUBLISHED

Description (CNA)

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

Affected (CNA)

Vendor / productVersions
Vaadin / Vaadinaffected 10.0.0 before *
Vaadin / flow-serveraffected 1.0.0 before *

CWE

CWE-754

References

ADP enrichment

CVE

No English description supplied.