GHSA-qcgx-crrx-38v5

ghsaUSosv

Denial of service in DataCommunicator class in Vaadin 8

view advisory published 2021-10-13Licence: CC-BY-4.0

Missing check in `DataCommunicator` class in `com.vaadin:vaadin-server` versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-33609US	medium4.3	0.95% (61st)	—	2021-10-13
Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap…

references

External citations — patches, advisories, analysis.

https://github.com/vaadin/frameworkPACKAGE
https://github.com/vaadin/framework/pull/12415WEB
https://github.com/vaadin/framework/security/advisories/GHSA-qcgx-crrx-38v5WEB
https://nvd.nist.gov/vuln/detail/CVE-2021-33609ADVISORY
https://vaadin.com/security/cve-2021-33609WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan