Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14
CVE-2021-33611

6.1MEDIUM

Key Information:

Vendor

Vaadin

Status
Vaadin
Vaadin-menu-bar
Vendor
CVE Published:
2 November 2021

What is CVE-2021-33611?

Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL

Affected Version(s)

Vaadin 14.0.0

Vaadin <= 14.4.4

vaadin-menu-bar 1.0.0

References

https://vaadin.com/security/cve-2021-33611
x_refsource_CONFIRM
https://github.com/vaadin/vaadin-menu-bar/pull/126
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.