{"id":"CVE-2021-33604","aliases":["EUVD-2021-1309","GHSA-c99r-67x4-whj6"],"status":"published","title":"Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19","description":"URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.","severity":{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00286,"percentile":0.21231,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-172"],"published":"2021-06-24T11:16:27Z","modified":"2026-11-05T10:45:06Z","fixes":[{"ecosystem":"Maven","package":"com.vaadin:vaadin-bom","fixed_in":["14.6.2","19.0.9"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.vaadin:vaadin-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"last_affected":"14.6.1"},{"fixed":"14.6.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.vaadin:vaadin-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0"},{"last_affected":"19.0.8"},{"fixed":"19.0.9"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.vaadin:vaadin-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"14.6.2"}]}],"versions":["14.0.0","14.0.1","14.0.10","14.0.11","14.0.12","14.0.13","14.0.14","14.0.15","14.0.2","14.0.3","14.0.4","14.0.5","14.0.6","14.0.7","14.0.8","14.0.9","14.1.0","14.1.1","14.1.16","14.1.17","14.1.18","14.1.19","14.1.2","14.1.20","14.1.21","14.1.22","14.1.23","14.1.24","14.1.25","14.1.26","14.1.27","14.1.28","14.1.3","14.1.4","14.1.5","14.2.0","14.2.1","14.2.2","14.2.3","14.3.0","14.3.1","14.3.2","14.3.3","14.3.4","14.3.5","14.3.6","14.3.7","14.3.8","14.3.9","14.4.0","14.4.1","14.4.10","14.4.2","14.4.3","14.4.4","14.4.5","14.4.6","14.4.7","14.4.8","14.4.9","14.5.0","14.5.1","14.5.2","14.5.3","14.5.4","14.5.5","14.6.0","14.6.1"]},{"source":"osv","ecosystem":"Maven","package":"com.vaadin:vaadin-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0"},{"fixed":"19.0.9"}]}],"versions":["15.0.0","15.0.1","15.0.2","15.0.3","15.0.4","15.0.5","15.0.6","16.0.0","16.0.1","16.0.2","16.0.3","16.0.4","16.0.5","17.0.0","17.0.1","17.0.10","17.0.11","17.0.2","17.0.3","17.0.4","17.0.6","17.0.7","17.0.8","17.0.9","18.0.0","18.0.1","18.0.2","18.0.3","18.0.4","18.0.5","18.0.6","18.0.7","19.0.0","19.0.1","19.0.2","19.0.3","19.0.4","19.0.5","19.0.6","19.0.7","19.0.8"]}],"products":[{"vendor":"flow","product":"flow-server"},{"vendor":"vaadin","product":"flow-server"},{"vendor":"vaadin","product":"vaadin"}],"references":[{"url":"https://vaadin.com/security/cve-2021-33604","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/vaadin/flow/pull/11099","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/vaadin/platform/security/advisories/GHSA-c99r-67x4-whj6","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33604","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c99r-67x4-whj6"},{"url":"https://github.com/vaadin/flow","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-33604","title":"Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19","description":"URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.","status":"published","published":"2021-06-24T11:16:27.149Z","modified":"2024-09-17T03:13:22.641Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-172"],"updated_at":"2026-11-02T14:33:10.204494Z"}],"euvd":[{"id":"EUVD-2021-1309","description":"URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.","status":"published","published":"2021-06-24T11:16:27Z","modified":"2024-09-17T03:13:22Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-03T00:28:33.76418Z"}],"ghsa":[{"id":"GHSA-c99r-67x4-whj6","title":"Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19","description":"URL encoding error in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.\n\n- https://vaadin.com/security/cve-2021-33604","status":"published","published":"2021-06-28T16:56:07Z","modified":"2023-02-01T05:06:09Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-172"],"updated_at":"2026-11-02T14:36:37.441118Z"}],"nvd":[{"id":"CVE-2021-33604","description":"URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.","status":"published","published":"2021-06-24T12:15:08.157Z","modified":"2026-06-17T03:54:51.847Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":1.2,"vector":"AV:L/AC:H/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-172"],"updated_at":"2026-11-02T14:06:54.892562Z"}],"osv":[{"id":"CVE-2021-33604","description":"URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.","status":"published","published":"2021-06-24T12:15:08.157Z","modified":"2026-11-08T10:45:21.158030549Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-08T02:57:30.447698Z"},{"id":"GHSA-c99r-67x4-whj6","title":"Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19","description":"URL encoding error in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.\n\n- https://vaadin.com/security/cve-2021-33604","status":"published","published":"2021-06-28T16:56:07Z","modified":"2024-02-17T05:31:46.93042Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-172"],"updated_at":"2026-11-02T15:46:44.927642Z"}]}}