GHSA-93c4-vf86-3rj7

ghsaUSosv

Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14

view advisory published 2021-11-03Licence: CC-BY-4.0

Missing output sanitization in test sources in `org.webjars.bowergithub.vaadin:vaadin-menu-bar` versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-33611US	medium6.1	0.99% (62nd)	—	2021-11-02
Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to…

references

External citations — patches, advisories, analysis.

https://github.com/vaadin/platformPACKAGE
https://github.com/vaadin/platform/security/advisories/GHSA-93c4-vf86-3rj7WEB
https://github.com/vaadin/vaadin-menu-bar/pull/126WEB
https://nvd.nist.gov/vuln/detail/CVE-2021-33611ADVISORY
https://vaadin.com/security/cve-2021-33611WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan