Homepage

com.vaadin:flow-server@1.0.13 vulnerabilities

  • latest version

    24.7.4

  • latest non vulnerable version

    24.7.4

  • first published

    6 years ago

  • latest version published

    14 days ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the com.vaadin:flow-server package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • L
    Debug Messages Revealing Unnecessary Information

    Affected versions of this package are vulnerable to Debug Messages Revealing Unnecessary Information in rpc/PublishedServerEventHandlerRpcHandler.java. Class and method names can be included in RPC responses when processing modified requests.

    How to fix Debug Messages Revealing Unnecessary Information?

    Upgrade com.vaadin:flow-server to version 1.0.21, 2.9.3, 9.1.2, 23.3.13, 24.0.9, 24.1.0 or higher.

    [1.0.0,1.0.21)[1.1.0,2.9.3)[3.0.0,9.1.2)[23.0.0,23.3.13)[24.0.0,24.0.9)[24.1.0.alpha1,24.1.0)
    • M
    Information Exposure

    Affected versions of this package are vulnerable to Information Exposure when adding non-visible components to the UI in the server side.

    How to fix Information Exposure?

    Upgrade com.vaadin:flow-server to version 1.0.20, 2.8.10, 9.1.1, 23.3.11, 24.0.8, 24.1.0 or higher.

    [1.0.0,1.0.20)[1.1.0,2.8.10)[3.0.0,9.1.1)[23.0.0,23.3.11)[24.0.0,24.0.8)[24.1.0.alpha1,24.1.0)
    • M
    Denial of Service (DoS)

    Affected versions of this package are vulnerable to Denial of Service (DoS). Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for NotFoundException is provided.

    How to fix Denial of Service (DoS)?

    Upgrade com.vaadin:flow-server to version 1.0.15, 2.6.2, 6.0.10 or higher.

    [1.0.0,1.0.15)[1.1.0,2.6.2)[3.0.0,6.0.10)
    • M
    Timing Attack

    Affected versions of this package are vulnerable to Timing Attack due to using inconstant time comparison for CSRF tokens in the UIDL request handler, allowing attackers to guess a security token.

    How to fix Timing Attack?

    Upgrade com.vaadin:flow-server to version 1.0.14, 2.4.7, 5.0.3 or higher.

    [,1.0.14)[1.1.0,2.4.7)[3.0.0,5.0.3)
    Go back to all versions of this package