CVE-2019-25027 MEDIUM

CVE-2019-25027: Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

Vendor Vaadin

Product Vaadin

Weakness CWE-81

Published April 23, 2021

Last update September 17, 2024

View on NVD All CVEs

CVSS base score

6.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL

Key dates

02Disclosure timeline

April 23, 2021 CVE published

September 17, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2019-25027 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/81.html

Identifiers

CVE CVE-2019-25027

CWE CWE-81

CVSS 6.1 / MEDIUM

Affected versions

Vendor Vaadin

Product Vaadin

Affected ≥ 10.0.0 and < *

Vendor Vaadin

Product flow-server

Affected ≥ 1.0.0 and < *