Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2019-25027

Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Vaadin

Description

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Vaadin Vaadin

  • 10.0.0 to < *affected

Vaadin flow-server

  • 1.0.0 to < *affected

References