PT-2021-8844 · Vaadin · Vaadin+1

Published 2021-04-19 · Updated 2021-05-05 · CVE-2018-25007

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions com.vaadin:flow-server versions 1.0.0 through 1.0.5 Vaadin versions 10.0.0 through 10.0.7 Vaadin versions 11.0.0 through 11.0.2

Description A missing check in the UIDL request handler allows an attacker to update element property values via a crafted synchronization message.

Recommendations For com.vaadin:flow-server versions 1.0.0 through 1.0.5, update to a version outside of the affected range. For Vaadin versions 10.0.0 through 10.0.7, update to a version outside of the affected range. For Vaadin versions 11.0.0 through 11.0.2, update to a version outside of the affected range. As a temporary workaround, consider restricting access to the UIDL request handler until a patch is available.

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2018-25007

GHSA-3H5R-928V-MXHH

GHSA-JMX8-355M-8VWH

Affected Products

Vaadin

Com.Vaadin:Flow-Server

References · 9

• https://github.com/vaadin/flow/pull/4774 · Patch
• https://vaadin.com/security/cve-2018-25007 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jmx8-355m-8vwh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3h5r-928v-mxhh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-25007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-25007 · Security Note
• https://github.com/vaadin/flow/security/advisories/GHSA-jmx8-355m-8vwh · Note
• https://github.com/vaadin/platform · Note
• https://github.com/vaadin/platform/security/advisories/GHSA-3h5r-928v-mxhh · Note