← CVE Intelligence

CVE-2021-33604

Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19 PUBLISHED

Description (CNA)

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

Affected (CNA)

Vendor / productVersions
Vaadin / Vaadinaffected 14.0.0 before unspecified; affected unspecified through 14.6.1; affected 15.0.0 before unspecified; affected unspecified through 19.0.8
Vaadin / flow-serveraffected 2.0.0 before unspecified; affected unspecified through 2.6.1; affected 3.0.0 before unspecified; affected unspecified through 6.0.9

CWE

CWE-172

References

ADP enrichment

CVE

No English description supplied.