Description
Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder.
Remediation
References
https://github.com/vaadin/flow/pull/9392
https://vaadin.com/security/cve-2020-36321
Related Vulnerabilities
CVE-2018-3715 Vulnerability in npm package glance
CVE-2016-3082 Vulnerability in maven package org.apache.struts:struts2-core
CVE-2019-17558 Vulnerability in maven package org.apache.solr:solr-velocity
CVE-2022-34298 Vulnerability in maven package org.openidentityplatform.openam:openam-auth-nt
CVE-2020-28052 Vulnerability in maven package bouncycastle:bcprov-jdk14