Description

Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.

Remediation

References

https://github.com/vaadin/flow/pull/10229

https://github.com/vaadin/flow/pull/10269

https://github.com/vaadin/osgi/issues/50

https://vaadin.com/security/cve-2021-31407

Related Vulnerabilities

CVE-2020-17527 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2021-42550 Vulnerability in maven package ch.qos.logback:logback-core

CVE-2021-46320 Vulnerability in npm package @openzeppelin/contracts

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.avmfritz

CVE-2016-3092 Vulnerability in maven package org.apache.tomcat:tomcat-catalina

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Patch Third Party Advisory Vendor Advisory CWE-668