CVE-2021-33604

2021-06-2412:15:08

Google

osv.dev

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.5%

JSON

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

CPENameOperatorVersion
platformeq15.0.0-beta2
platformeq18.0.0-beta3
platformeq14.2.0.alpha9
platformeq14.6.0
platformeq15.0.0-beta4
platformeq14.2.0-alpha7
platformeq19.0.0.alpha3
platformeq14.6.0.beta2
platformeq14.6.0-alpha1
platformeq14.5.0-alpha1

Name	Operator	Version
platform	eq	15.0.0-beta2
platform	eq	18.0.0-beta3
platform	eq	14.2.0.alpha9
platform	eq	14.6.0
platform	eq	15.0.0-beta4
platform	eq	14.2.0-alpha7
platform	eq	19.0.0.alpha3
platform	eq	14.6.0.beta2
platform	eq	14.6.0-alpha1
platform	eq	14.5.0-alpha1