CVE-2021-33604 Vulnerability Details

  /     /     /  

CVE-2021-33604 Metadata Quick Info

CVE Published: 24/06/2021 | CVE Updated: 17/09/2024 | CVE Year: 2021
Source: Vaadin | Vendor: Vaadin | Product: Vaadin
Status : PUBLISHED

---

CVE-2021-33604 Description

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

Metrics

CVSS Version: 3.1 | Base Score: 2.5 LOW
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)* LOCAL
    Attack Complexity (AC)* HIGH
    Privileges Required (PR)* NONE
    User Interaction (UI)* REQUIRED
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* LOW
    Integrity Impact (I)* NONE
    Availability Impact (A)* NONE

Weakness Enumeration (CWE)

CWE-ID: CWE-172
CWE Name: CWE-172 Encoding Error
Source: Vaadin

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).