com.vaadin:flow-server 1.3.0 vulnerabilities

Known vulnerabilities in the com.vaadin:flow-server package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
L Debug Messages Revealing Unnecessary Information Affected versions of this package are vulnerable to Debug Messages Revealing Unnecessary Information in `rpc/PublishedServerEventHandlerRpcHandler.java`. Class and method names can be included in RPC responses when processing modified requests. How to fix Debug Messages Revealing Unnecessary Information? Upgrade `com.vaadin:flow-server` to version 1.0.21, 2.9.3, 9.1.2, 23.3.13, 24.0.9, 24.1.0 or higher.	[1.0.0,1.0.21)[1.1.0,2.9.3)[3.0.0,9.1.2)[23.0.0,23.3.13)[24.0.0,24.0.9)[24.1.0.alpha1,24.1.0)
M Information Exposure Affected versions of this package are vulnerable to Information Exposure when adding non-visible components to the UI in the server side. How to fix Information Exposure? Upgrade `com.vaadin:flow-server` to version 1.0.20, 2.8.10, 9.1.1, 23.3.11, 24.0.8, 24.1.0 or higher.	[1.0.0,1.0.20)[1.1.0,2.8.10)[3.0.0,9.1.1)[23.0.0,23.3.11)[24.0.0,24.0.8)[24.1.0.alpha1,24.1.0)
M Denial of Service (DoS) Affected versions of this package are vulnerable to Denial of Service (DoS). Improper sanitization of path in default `RouteNotFoundError` view in `com.vaadin:flow-server` allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for `NotFoundException` is provided. How to fix Denial of Service (DoS)? Upgrade `com.vaadin:flow-server` to version 1.0.15, 2.6.2, 6.0.10 or higher.	[1.0.0,1.0.15)[1.1.0,2.6.2)[3.0.0,6.0.10)
H Information Exposure Affected versions of this package are vulnerable to Information Exposure. Vulnerability in OSGi integration allows an attacker to access application classes and resources on the server via crafted HTTP request. How to fix Information Exposure? Upgrade `com.vaadin:flow-server` to version 6.0.2, 2.4.8 or higher.	[6.0.0,6.0.2)[1.2.0,2.4.8)
M Cross-site Scripting (XSS) Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Missing output sanitization in default `RouteNotFoundError` view allows an attacker to execute malicious JavaScript via a crafted URL. How to fix Cross-site Scripting (XSS)? Upgrade `com.vaadin:flow-server` to version 1.4.3, 1.0.11 or higher.	[1.1.0,1.4.3)[1.0.0,1.0.11)
M Timing Attack Affected versions of this package are vulnerable to Timing Attack due to using inconstant time comparison for CSRF tokens in the UIDL request handler, allowing attackers to guess a security token. How to fix Timing Attack? Upgrade `com.vaadin:flow-server` to version 1.0.14, 2.4.7, 5.0.3 or higher.	[,1.0.14)[1.1.0,2.4.7)[3.0.0,5.0.3)

Vulnerability

Vulnerable Version

Debug Messages Revealing Unnecessary Information

Affected versions of this package are vulnerable to Debug Messages Revealing Unnecessary Information in rpc/PublishedServerEventHandlerRpcHandler.java. Class and method names can be included in RPC responses when processing modified requests.

How to fix Debug Messages Revealing Unnecessary Information?

Upgrade com.vaadin:flow-server to version 1.0.21, 2.9.3, 9.1.2, 23.3.13, 24.0.9, 24.1.0 or higher.

[1.0.0,1.0.21)[1.1.0,2.9.3)[3.0.0,9.1.2)[23.0.0,23.3.13)[24.0.0,24.0.9)[24.1.0.alpha1,24.1.0)

Information Exposure

Affected versions of this package are vulnerable to Information Exposure when adding non-visible components to the UI in the server side.

How to fix Information Exposure?

Upgrade com.vaadin:flow-server to version 1.0.20, 2.8.10, 9.1.1, 23.3.11, 24.0.8, 24.1.0 or higher.

[1.0.0,1.0.20)[1.1.0,2.8.10)[3.0.0,9.1.1)[23.0.0,23.3.11)[24.0.0,24.0.8)[24.1.0.alpha1,24.1.0)

Denial of Service (DoS)

Affected versions of this package are vulnerable to Denial of Service (DoS). Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for NotFoundException is provided.

How to fix Denial of Service (DoS)?

Upgrade com.vaadin:flow-server to version 1.0.15, 2.6.2, 6.0.10 or higher.

[1.0.0,1.0.15)[1.1.0,2.6.2)[3.0.0,6.0.10)

Information Exposure

Affected versions of this package are vulnerable to Information Exposure. Vulnerability in OSGi integration allows an attacker to access application classes and resources on the server via crafted HTTP request.

How to fix Information Exposure?

Upgrade com.vaadin:flow-server to version 6.0.2, 2.4.8 or higher.

[6.0.0,6.0.2)[1.2.0,2.4.8)

Cross-site Scripting (XSS)

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Missing output sanitization in default RouteNotFoundError view allows an attacker to execute malicious JavaScript via a crafted URL.

How to fix Cross-site Scripting (XSS)?

Upgrade com.vaadin:flow-server to version 1.4.3, 1.0.11 or higher.

[1.1.0,1.4.3)[1.0.0,1.0.11)

Timing Attack

Affected versions of this package are vulnerable to Timing Attack due to using inconstant time comparison for CSRF tokens in the UIDL request handler, allowing attackers to guess a security token.

How to fix Timing Attack?

Upgrade com.vaadin:flow-server to version 1.0.14, 2.4.7, 5.0.3 or higher.

[,1.0.14)[1.1.0,2.4.7)[3.0.0,5.0.3)

com.vaadin:flow-server@1.3.0 vulnerabilities

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

How to fix?