Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2021-33611

Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Vaadin

Description

Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Vaadin Vaadin

  • 14.0.0 to < unspecifiedaffected
  • unspecified to ≤ 14.4.4affected

Vaadin vaadin-menu-bar

  • 1.0.0 to < unspecifiedaffected
  • unspecified to ≤ 1.2.0affected

References