PT-2021-20230 · Vaadin · Vaadin-Server

Published 2021-10-13 · Updated 2022-10-27 · CVE-2021-33609

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: com.vaadin:vaadin-server versions 8.0.0 through 8.14.0

Description: The issue is caused by a missing check in the DataCommunicator class, allowing an authenticated network attacker to cause heap exhaustion by requesting too many rows of data.

Recommendations: For versions 8.0.0 through 8.14.0, consider disabling the DataCommunicator class or restricting the amount of data that can be requested to prevent heap exhaustion until a patch is available.

Fix

RCE

Resource Exhaustion

Weakness Enumeration

CWE-20

CWE-400

Related Identifiers

CVE-2021-33609

GHSA-J23J-Q57M-63V3

GHSA-QCGX-CRRX-38V5

Affected Products

Vaadin-Server

References · 10

• https://github.com/vaadin/framework/pull/12415 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-33609 · Security Note
• https://osv.dev/vulnerability/GHSA-j23j-q57m-63v3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33609 · Vendor Advisory
• https://vaadin.com/security/cve-2021-33609 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qcgx-crrx-38v5 · Vendor Advisory
• https://github.com/vaadin/framework · Note
• https://github.com/vaadin/framework/security/advisories/GHSA-qcgx-crrx-38v5 · Note
• https://github.com/vaadin/framework/security/advisories/GHSA-j23j-q57m-63v3 · Note
• https://t.me/cibsecurity/30496 · Telegram Post