GHSA-3h5r-928v-mxhh
Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.
- Record
GHSA-3h5r-928v-mxhh- CVSS 3.1
- 2.6 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-754
- Updated
- 2026-11-02
OSV
Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.
- Record
GHSA-3h5r-928v-mxhh- CVSS 3.1
- 2.6 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-754
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.vaadin:vaadin-bomMaven | 10.0.0 up to 10.0.8 | 10.0.8 |
com.vaadin:vaadin-bomMaven | 11.0.0 up to 11.0.3 | 11.0.3 |
com.vaadin:vaadin-bomMaven | 10.0.0 up to 10.0.8, plus listed versions 10.0.110.0.210.0.310.0.410.0.510.0.610.0.7 | 10.0.8 |
com.vaadin:vaadin-bomMaven | 11.0.0 up to 11.0.3, plus listed versions 11.0.111.0.2 | 11.0.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-3h5r-928v-mxhh is a low vulnerability (CVSS 2.6) in com.vaadin:vaadin-bom, published April 19, 2021. No source lists public exploit code. Fixed in com.vaadin:vaadin-bom 10.0.8.