GHSA-j9wr-49vq-rm5g

Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19

8.6 HighFix available

GHSA-j9wr-49vq-rm5g is a high vulnerability (CVSS 8.6) in com.vaadin:vaadin-bom, published April 19, 2021. No source lists public exploit code. Fixed in com.vaadin:vaadin-bom 14.4.10.

Severity: 8.6 HighCVSS 3.1, GitHub Advisories
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 14.4.10com.vaadin:vaadin-bom +3 more

Description

Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.

https://vaadin.com/security/cve-2021-31407

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Affected packages

Affected packages
Package	Affected	Fixed
`com.vaadin:vaadin-bom` Maven	12.0.0 up to 14.4.10	14.4.10
`com.vaadin:vaadin-bom` Maven	19.0.0 to 19.0.0	19.0.1
`com.vaadin:vaadin-bom` Maven	12.0.0 up to 14.4.10, plus listed versions 12.0.112.0.212.0.312.0.412.0.5 Show 45 moreShow less 12.0.612.0.713.0.013.0.113.0.1013.0.1113.0.1213.0.1313.0.213.0.313.0.413.0.513.0.613.0.713.0.813.0.914.0.014.0.114.0.1014.0.1114.0.1214.0.1314.0.1414.0.1514.0.214.0.314.0.414.0.514.0.614.0.714.0.814.0.914.1.014.1.114.1.1614.1.1714.1.1814.1.1914.1.214.1.2014.1.2114.1.2214.1.2314.1.2414.1.25	14.4.10
`com.vaadin:vaadin-bom` Maven	19.0.0 up to 19.0.1	19.0.1