GHSA-jqj4-r483-4gvr
Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
GHSA-jqj4-r483-4gvr is a medium vulnerability (CVSS 6.1) in com.vaadin:vaadin-bom, published April 19, 2021. No source lists public exploit code. Fixed in com.vaadin:vaadin-bom 10.0.14.
- Severity
- 6.1 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
10.0.14com.vaadin:vaadin-bom +3 more
Description
Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.vaadin:vaadin-bomMaven | 10.0.0 up to 10.0.14 | 10.0.14 |
com.vaadin:vaadin-bomMaven | 11.0.0 up to 13.0.6 | 13.0.6 |
com.vaadin:vaadin-bomMaven | 10.0.0 up to 10.0.14, plus listed versions 10.0.110.0.1010.0.1110.0.1210.0.13 Show 8 moreShow less10.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.9 | 10.0.14 |
com.vaadin:vaadin-bomMaven | 11.0.0 up to 13.0.6, plus listed versions 11.0.111.0.211.0.311.0.412.0.0 Show 13 moreShow less12.0.112.0.212.0.312.0.412.0.512.0.612.0.713.0.013.0.113.0.213.0.313.0.413.0.5 | 13.0.6 |
What each source reports
GitHub Advisories Score used
Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL.
- Record
GHSA-jqj4-r483-4gvr- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-81
- Updated
- 2026-11-02
OSV
Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL.
- Record
GHSA-jqj4-r483-4gvr- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-81
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.