OSGi applications using Vaadin 12-14 and 19 vulnerable to server classes and resources exposure
Vulnerability in OSGi integration in `com.vaadin:flow-server` versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request. - https://vaadin.com/security/cve-2021-31407
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-31407US | high7.5 | — | ||
Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/vaadin/flowPACKAGE
- https://github.com/vaadin/flow/pull/10229WEB
- https://github.com/vaadin/flow/pull/10269WEB
- https://github.com/vaadin/flow/security/advisories/GHSA-25xc-jwfq-39jwWEB
- https://github.com/vaadin/osgi/issues/50WEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-31407ADVISORY
- https://vaadin.com/security/cve-2021-31407WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan