GHSA-rp4x-wxqv-cf9m

Опубликовано: 19 апр. 2021

Источник: github

Github: Прошло ревью

CVSS3: 6.1

Описание

Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL.

https://vaadin.com/security/cve-2019-25027

Ссылки

Пакеты

Наименование

com.vaadin:flow-server

maven

Затронутые версииВерсия исправления

>= 1.0.0, < 1.0.11

1.0.11

Наименование

com.vaadin:flow-server

maven

Затронутые версииВерсия исправления

>= 1.1.0, < 1.4.3

1.4.3

EPSS

Процентиль: 58%

0.00371

Низкий

6.1 Medium

CVSS3

CVE ID

CVE-2019-25027

Дефекты

CWE-79

CWE-81

Связанные уязвимости

CVE-2019-25027

CVSS3: 6.1

nvd

почти 5 лет назад

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL

EPSS

Процентиль: 58%

0.00371

Низкий

6.1 Medium

CVSS3

CVE ID

CVE-2019-25027

Дефекты

CWE-79

CWE-81