OSGi applications using Vaadin 12-14 and 19 vulnerable to server classes and resources exposure
Vulnerability in OSGi integration in `com.vaadin:flow-server` versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request. - https://vaadin.com/security/cve-2021-31407
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-31407US | high7.5 | — | ||
Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/vaadin/flowPACKAGE
- https://github.com/vaadin/flow/pull/10229WEB
- https://github.com/vaadin/flow/pull/10269WEB
- https://github.com/vaadin/flow/security/advisories/GHSA-25xc-jwfq-39jwWEB
- https://github.com/vaadin/osgi/issues/50WEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-31407ADVISORY
- https://vaadin.com/security/cve-2021-31407WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan