{"id":"CVE-2021-33611","aliases":["EUVD-2021-2327","GHSA-93c4-vf86-3rj7"],"status":"published","title":"Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14","description":"Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00986,"percentile":0.62841,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2021-11-02T10:06:56Z","modified":"2026-10-24T10:50:42Z","fixes":[{"ecosystem":"Maven","package":"com.vaadin:vaadin-bom","fixed_in":["14.4.5"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.webjars.bowergithub.vaadin:vaadin-menu-bar","fixed_in":["1.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.vaadin:vaadin-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"last_affected":"14.4.4"},{"fixed":"14.4.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.webjars.bowergithub.vaadin:vaadin-menu-bar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"last_affected":"1.2.0"},{"fixed":"1.2.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.vaadin:vaadin-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14.0.0"},{"fixed":"14.4.5"}]}],"versions":["14.0.0","14.0.1","14.0.10","14.0.11","14.0.12","14.0.13","14.0.14","14.0.15","14.0.2","14.0.3","14.0.4","14.0.5","14.0.6","14.0.7","14.0.8","14.0.9","14.1.0","14.1.1","14.1.16","14.1.17","14.1.18","14.1.19","14.1.2","14.1.20","14.1.21","14.1.22","14.1.23","14.1.24","14.1.25","14.1.26","14.1.27","14.1.28","14.1.3","14.1.4","14.1.5","14.2.0","14.2.1","14.2.2","14.2.3","14.3.0","14.3.1","14.3.2","14.3.3","14.3.4","14.3.5","14.3.6","14.3.7","14.3.8","14.3.9","14.4.0","14.4.1","14.4.2","14.4.3","14.4.4"]},{"source":"osv","ecosystem":"Maven","package":"org.webjars.bowergithub.vaadin:vaadin-menu-bar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.2.1"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.1.0","1.1.0-alpha1","1.1.0-alpha2","1.2.0","1.2.0-alpha1","1.2.0-beta1"]}],"products":[{"vendor":"vaadin","product":"vaadin"},{"vendor":"vaadin","product":"vaadin-menu-bar"}],"references":[{"url":"https://vaadin.com/security/cve-2021-33611","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/vaadin/vaadin-menu-bar/pull/126","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/vaadin/platform/security/advisories/GHSA-93c4-vf86-3rj7","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33611","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-93c4-vf86-3rj7"},{"url":"https://github.com/vaadin/platform","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-33611","title":"Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14","description":"Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL","status":"published","published":"2021-11-02T10:06:56.037Z","modified":"2024-09-17T02:32:32.326Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:10.204494Z"}],"euvd":[{"id":"EUVD-2021-2327","description":"Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL","status":"published","published":"2021-11-02T10:06:56Z","modified":"2024-09-17T02:32:32Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:28:39.580336Z"}],"ghsa":[{"id":"GHSA-93c4-vf86-3rj7","title":"Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14","description":"Missing output sanitization in test sources in `org.webjars.bowergithub.vaadin:vaadin-menu-bar` versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL.","status":"published","published":"2021-11-03T17:33:32Z","modified":"2023-02-01T05:06:25Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:39.086869Z"}],"nvd":[{"id":"CVE-2021-33611","description":"Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL","status":"published","published":"2021-11-02T10:15:07.683Z","modified":"2026-06-17T03:54:52.23Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:00.549994Z"}],"osv":[{"id":"CVE-2021-33611","description":"Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL","status":"published","published":"2021-11-02T10:15:07.683Z","modified":"2026-10-24T10:50:42.072747969Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"GHSA-93c4-vf86-3rj7","title":"Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14","description":"Missing output sanitization in test sources in `org.webjars.bowergithub.vaadin:vaadin-menu-bar` versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL.","status":"published","published":"2021-11-03T17:33:32Z","modified":"2023-11-08T04:06:05.923539Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:43.123867Z"}]}}