CVSS 3.1
2.5 lowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:NCVE-2021-33604
Low (2.5) in vaadin. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in com.vaadin:vaadin-bom 14.6.2, 19.0.9.
URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
- CWE
- CWE-172
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vaadin:flow-server
- vaadin:vaadin
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c99r-67x4-whj6 | Maven | com.vaadin:vaadin-bom | >=14.0.0 <14.6.2 | 14.6.2 |
| GHSA-c99r-67x4-whj6 | Maven | com.vaadin:vaadin-bom | >=15.0.0 <19.0.9 | 19.0.9 |