CVE-2025-15022

mediumPriorität · verfolgen · 0EPSS 0.003 · 26. PerzentilDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.33% (26th) EPSS

CVSS 4.8 · medium

Is it mine?

26 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · osv

EPSS · bewertet 2026-10-27

Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from user input. In Vaadin Framework 7 and 8, the Action class is a general-purpose class that may be used by multiple components. The fixed versions sanitize captions by default and provide an API to explicitly enable HTML content mode for backwards compatibility. In Vaadin 23 and newer, the Action class is only used by the Spreadsheet component. The fixed versions sanitize HTML using Jsoup with a relaxed safelist. Vaadin 14 is not affected as Spreadsheet component was not supported. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 7.0.0 - 7.7.49 Vaadin 8.0.0 - 8.29.1 Vaadin 23.1.0 - 23.6.5 Vaadin 24.0.0 - 24.8.13 Vaadin 24.9.0 - 24.9.6 Mitigation Upgrade to 7.7.50 Upgrade to 8.30.0 Upgrade to 23.6.6 Upgrade to 24.8.14 or 24.9.7 Upgrade to 25.0.0 or newer Artifacts Maven coordinatesVulnerable versionsFixed versioncom.vaadin:vaadin-server 7.0.0 - 7.7.49 ≥7.7.50 com.vaadin:vaadin-server 8.0.0 - 8.29.1 ≥8.30.0 com.vaadin:vaadin 23.1.0 - 23.6.5 ≥23.6.6 com.vaadin:vaadin24.0.0 - 24.8.13 ≥24.8.14 com.vaadin:vaadin24.9.0 - 24.9.6 ≥24.9.7 com.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.5 ≥23.6.6 com.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.8.13 ≥24.8.14 com.vaadin:vaadin-spreadsheet-flow 24.9.0 - 24.9.6 ≥24.9.7

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

4.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 1.1–4.8

v4.04.8mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Ambersecondary · ENISA EU

v4.04.8mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Ambersecondary · security@vaadin.com

v4.01.1lowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Ambersecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-79USCWE-79US

betroffene Produkte (26)

Betroffene Produkte und Versionsbereiche.

Open Source Vaadin <23.6.6alle Versionencert_bundDE
Open Source Vaadin <24.8.14alle Versionencert_bundDE
Open Source Vaadin <24.9.7alle Versionencert_bundDE
Open Source Vaadin <7.7.50alle Versionencert_bundDE
Open Source Vaadin <8.30.0alle Versionencert_bundDE
Open Source Vaadin< 23.6.6cert_bundDE
Open Source Vaadin< 24.8.14cert_bundDE
Open Source Vaadin< 24.9.7cert_bundDE
Open Source Vaadin< 7.7.50cert_bundDE
Open Source Vaadin< 8.30.0cert_bundDE
Vaadin Vaadin≤ 24.9.0 ≤24.9.6enisa_euvdEU
Vaadin Vaadin≤ 24.0.0 ≤24.8.13enisa_euvdEU
Vaadin Vaadin≤ 23.1.0 ≤23.6.5enisa_euvdEU
Vaadin framework≤ 7.0.0 ≤7.7.49enisa_euvdEU
Vaadin framework≤ 8.0.0 ≤8.29.1enisa_euvdEU
Vaadin vaadin-spreadsheet-flow≤ 24.9.0 ≤24.9.6enisa_euvdEU
Vaadin vaadin-spreadsheet-flow≤ 24.0.0 ≤24.8.13enisa_euvdEU
Vaadin vaadin-spreadsheet-flow≤ 23.1.0 ≤23.6.5enisa_euvdEU
Maven com.vaadin:vaadin23.1.0 → 23.6.6osvUSpkg:maven/com.vaadin/vaadin
Maven com.vaadin:vaadin24.0.0 → 24.8.14osvUSpkg:maven/com.vaadin/vaadin

20 von 26 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2026-0003Vaadin: Schwachstelle ermöglicht Cross-Site ScriptingDeutsch2026-01-04csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Vaadin ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
GHSA-7wwv-79xw-rvvgVaadin vulnerable to Cross-site Scripting2026-01-05ghsa · osvUS
Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from user input. In Vaadin Framework 7 and 8, the Action class is a general-purpose class that may be used by multiple components. The fixed versions sanitize captions by default and provide an API to explicitly enable HTML content mode for backwards compatibility. In Vaadin 23 and newer, the Action class is only used by the Spreadsheet component. The fixed versions sanitize HTML using Jsoup with a relaxed safelist. Vaadin 14 is not affected as Spreadsheet component was not supported. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 7.0.0 - 7.7.49 Vaadin 8.0.0 - 8.29.1 Vaadin 23.1.0 - 23.6.5 Vaadin 24.0.0 - 24.8.13 Vaadin 24.9.0 - 24.9.6 Mitigation Upgrade to 7.7.50 Upgrade to 8.30.0 Upgrade to 23.6.6 Upgrade to 24.8.14 or 24.9.7 Upgrade to 25.0.0 or newer Artifacts Maven coordinatesVulnerable versionsFixed versioncom.vaadin:vaadin-server 7.0.0 - 7.7.49 ≥7.7.50 com.vaadin:vaadin-server 8.0.0 - 8.29.1 ≥8.30.0 com.vaadin:vaadin 23.1.0 - 23.6.5 ≥23.6.6 com.vaadin:vaadin24.0.0 - 24.8.13 ≥24.8.14 com.vaadin:vaadin24.9.0 - 24.9.6 ≥24.9.7 com.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.5 ≥23.6.6 com.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.8.13 ≥24.8.14 com.vaadin:vaadin-spreadsheet-flow 24.9.0 - 24.9.6 ≥24.9.7

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cert_bund osv NVD CVE.org MITRE

veröffentlicht 2026-01-05geändert 2026-06-17

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan