CVE-2021-33609 MEDIUM

CVE-2021-33609: Denial of service in DataCommunicator class in Vaadin 8

Vendor Vaadin
Product Vaadin
Weakness CWE-400
Published October 13, 2021
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.

Key dates

02Disclosure timeline

October 13, 2021 CVE published
September 16, 2024 Record updated