CVE-2019-25027

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL

Score

CVSS 3.1 6.1 Medium

Status

Modified - security@vaadin.com

Published

2021-04-23

Last modified

2024-09-17

Weaknesses

CWE-79, CWE-81

Affected products

• Flow (Vaadin)
• Flow-server (Vaadin)
• Vaadin (Vaadin)

References

• https://github.com/vaadin/flow/pull/5498
• https://vaadin.com/security/cve-2019-25027