GHSA-fr26-qjc8-mvjx
Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
GHSA-fr26-qjc8-mvjx is a medium vulnerability (CVSS 5.3) in com.vaadin:flow-server, published October 13, 2021. No source lists public exploit code. Fixed in com.vaadin:flow-server 1.0.15.
- Severity
- 5.3 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.0.15com.vaadin:flow-server +5 more
Description
Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for NotFoundException is provided.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.vaadin:flow-serverMaven | 1.0.0 up to 1.0.15 | 1.0.15 |
com.vaadin:flow-serverMaven | 1.1.0 up to 2.6.2 | 2.6.2 |
com.vaadin:flow-serverMaven | 3.0.0 up to 6.0.10 | 6.0.10 |
com.vaadin:flow-serverMaven | 1.0.0 up to 1.0.15, plus listed versions 1.0.11.0.101.0.111.0.121.0.13 Show 9 moreShow less1.0.141.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.9 | 1.0.15 |
com.vaadin:flow-serverMaven | 1.1.0 up to 2.6.2, plus listed versions 1.2.01.2.11.2.21.2.31.2.4 Show 45 moreShow less1.2.51.3.01.4.01.4.11.4.21.4.31.4.41.4.51.4.61.4.71.4.82.0.02.0.12.0.102.0.112.0.122.0.132.0.142.0.152.0.162.0.172.0.182.0.192.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.1.02.1.0.beta22.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0.alpha112.2.1 | 2.6.2 |
com.vaadin:flow-serverMaven | 3.0.0 up to 6.0.10, plus listed versions 3.0.13.0.23.0.33.0.43.0.5 Show 33 moreShow less3.0.63.0.73.1.03.1.13.1.23.1.33.1.53.1.63.1.74.0.04.0.14.0.24.0.34.0.44.0.54.0.64.0.74.0.85.0.05.0.15.0.25.0.35.0.46.0.06.0.16.0.26.0.36.0.46.0.56.0.66.0.76.0.86.0.9 | 6.0.10 |
What each source reports
GitHub Advisories Score used
Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for NotFoundException is provided.
- Record
GHSA-fr26-qjc8-mvjx- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSV
Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for NotFoundException is provided.
- Record
GHSA-fr26-qjc8-mvjx- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 28 versions. The JSON record has them.