Stored cross-site scripting in Grid component in Vaadin 7 and 8
CVE-2019-25028

5.4MEDIUM

Key Information:

Vendor

Vaadin

Status
Vaadin
Vaadin-server
Vendor
CVE Published:
23 April 2021

What is CVE-2019-25028?

Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector

Affected Version(s)

Vaadin 7.4.0

vaadin-server 7.4.0

References

https://vaadin.com/security/cve-2019-25028
x_refsource_MISC
https://github.com/vaadin/framework/pull/11644
x_refsource_MISC
https://github.com/vaadin/framework/pull/11645
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered and responsibly reported by MATE Marketing Technologie
.