{"id":"GHSA-76f4-fw33-6j2v","aliases":[],"status":"published","title":"Potential sensitive data exposure in applications using Vaadin 15","description":"Insecure configuration of default `ObjectMapper` in `com.vaadin:flow-server` versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. `@RestController`\n\n- https://vaadin.com/security/cve-2020-36319","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2021-04-19T14:48:26Z","modified":"2024-12-02T05:26:03Z","fixes":[{"ecosystem":"Maven","package":"com.vaadin:vaadin-bom","fixed_in":["15.0.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.vaadin:vaadin-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0"},{"fixed":"15.0.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.vaadin:vaadin-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.0.0"},{"fixed":"15.0.5"}]}],"versions":["15.0.0","15.0.1","15.0.2","15.0.3","15.0.4"]}],"references":[{"url":"https://github.com/vaadin/platform/security/advisories/GHSA-76f4-fw33-6j2v","tags":["web"]},{"url":"https://vaadin.com/security/cve-2020-36319","tags":["web"]},{"url":"https://github.com/advisories/GHSA-76f4-fw33-6j2v"},{"url":"https://github.com/vaadin/platform","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-76f4-fw33-6j2v","title":"Potential sensitive data exposure in applications using Vaadin 15","description":"Insecure configuration of default `ObjectMapper` in `com.vaadin:flow-server` versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. `@RestController`\n\n- https://vaadin.com/security/cve-2020-36319","status":"published","published":"2021-04-19T14:48:26Z","modified":"2023-01-09T05:04:15Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:09.554044Z"}],"osv":[{"id":"GHSA-76f4-fw33-6j2v","title":"Potential sensitive data exposure in applications using Vaadin 15","description":"Insecure configuration of default `ObjectMapper` in `com.vaadin:flow-server` versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. `@RestController`\n\n- https://vaadin.com/security/cve-2020-36319","status":"published","published":"2021-04-19T14:48:26Z","modified":"2024-12-02T05:26:03.528Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:40.657155Z"}]}}