CVE-2018-25007

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

Score

CVSS 3.1 4.3 Medium

Status

Modified - security@vaadin.com

Published

2021-04-23

Last modified

2024-09-16

Weaknesses

CWE-754

Affected products

• Flow (Vaadin)
• Flow-server (Vaadin)
• Vaadin (Vaadin)

References

• https://github.com/vaadin/flow/pull/4774
• https://vaadin.com/security/cve-2018-25007