Vulnerability Details : CVE-2021-33604
URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.
Products affected by CVE-2021-33604
- cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*
- cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*
- cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*
- cpe:2.3:a:vaadin:flow-server:*:*:*:*:*:*:*:*
- cpe:2.3:a:vaadin:flow-server:*:*:*:*:*:*:*:*
- cpe:2.3:a:vaadin:flow-server:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-33604
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 21 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-33604
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
1.2
|
LOW | AV:L/AC:H/Au:N/C:P/I:N/A:N |
1.9
|
2.9
|
NIST | |
|
2.5
|
LOW | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N |
1.0
|
1.4
|
NIST | |
|
2.5
|
LOW | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N |
1.0
|
1.4
|
Vaadin Ltd. |
CWE ids for CVE-2021-33604
-
The product does not properly encode or decode the data, resulting in unexpected values.Assigned by: security@vaadin.com (Secondary)
References for CVE-2021-33604
-
https://github.com/vaadin/flow/pull/11099
fix: prevent passing bad character to dev-server by pleku · Pull Request #11099 · vaadin/flow · GitHubPatch;Third Party Advisory
-
https://vaadin.com/security/cve-2021-33604
CVE-2021-33604: Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19Vendor Advisory
Jump to