Description
Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder.
Remediation
References
https://github.com/vaadin/flow/pull/9392
https://vaadin.com/security/cve-2020-36321
Related Vulnerabilities
CVE-2018-1002202 Vulnerability in maven package net.lingala.zip4j:zip4j
CVE-2012-0803 Vulnerability in maven package org.apache.cxf:cxf-bundle-minimal
CVE-2022-2596 Vulnerability in npm package node-fetch
CVE-2019-10773 Vulnerability in npm package @pnpm/package-bins
CVE-2022-41932 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore