com.vaadin:flow-server 3.0.3 vulnerabilities

Known vulnerabilities in the com.vaadin:flow-server package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
L Debug Messages Revealing Unnecessary Information Affected versions of this package are vulnerable to Debug Messages Revealing Unnecessary Information in `rpc/PublishedServerEventHandlerRpcHandler.java`. Class and method names can be included in RPC responses when processing modified requests. How to fix Debug Messages Revealing Unnecessary Information? Upgrade `com.vaadin:flow-server` to version 1.0.21, 2.9.3, 9.1.2, 23.3.13, 24.0.9, 24.1.0 or higher.	[1.0.0,1.0.21)[1.1.0,2.9.3)[3.0.0,9.1.2)[23.0.0,23.3.13)[24.0.0,24.0.9)[24.1.0.alpha1,24.1.0)
M Information Exposure Affected versions of this package are vulnerable to Information Exposure when adding non-visible components to the UI in the server side. How to fix Information Exposure? Upgrade `com.vaadin:flow-server` to version 1.0.20, 2.8.10, 9.1.1, 23.3.11, 24.0.8, 24.1.0 or higher.	[1.0.0,1.0.20)[1.1.0,2.8.10)[3.0.0,9.1.1)[23.0.0,23.3.11)[24.0.0,24.0.8)[24.1.0.alpha1,24.1.0)
L Cross-site Scripting (XSS) Affected versions of this package are vulnerable to Cross-site Scripting (XSS). URL encoding error in development mode handler allows local user to execute arbitrary JavaScript code by opening crafted URL in browser. How to fix Cross-site Scripting (XSS)? Upgrade `com.vaadin:flow-server` to version 2.6.2, 6.0.10 or higher.	[2.0.0,2.6.2)[3.0.0,6.0.10)
M Denial of Service (DoS) Affected versions of this package are vulnerable to Denial of Service (DoS). Improper sanitization of path in default `RouteNotFoundError` view in `com.vaadin:flow-server` allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for `NotFoundException` is provided. How to fix Denial of Service (DoS)? Upgrade `com.vaadin:flow-server` to version 1.0.15, 2.6.2, 6.0.10 or higher.	[1.0.0,1.0.15)[1.1.0,2.6.2)[3.0.0,6.0.10)
M Insecure Permissions Affected versions of this package are vulnerable to Insecure Permissions. Insecure temporary directory usage in frontend build functionality allows local users to inject malicious code into frontend resources during application rebuilds. How to fix Insecure Permissions? Upgrade `com.vaadin:flow-server` to version 6.0.6, 2.5.3 or higher.	[3.0.0,6.0.6)[2.0.9,2.5.3)
L Information Exposure Affected versions of this package are vulnerable to Information Exposure. Insecure configuration of default `ObjectMapper` may expose sensitive data if the application also uses e.g. `@RestController` How to fix Information Exposure? Upgrade `com.vaadin:flow-server` to version 3.0.6 or higher.	[3.0.0,3.0.6)
M Timing Attack Affected versions of this package are vulnerable to Timing Attack. Non-constant-time comparison of CSRF tokens in endpoint request handler allows an attacker to guess a security token for Fusion endpoints via timing attack. How to fix Timing Attack? Upgrade `com.vaadin:flow-server` to version 5.0.4 or higher.	[3.0.0,5.0.4)
M Directory Traversal Affected versions of this package are vulnerable to Directory Traversal. Improper URL validation in development mode handler allows attackers to request arbitrary files stored outside of intended frontend resources folder. How to fix Directory Traversal? Upgrade `com.vaadin:flow-server` to version 5.0.0, 2.4.2 or higher.	[3.0.0,5.0.0)[2.0.0,2.4.2)
M Timing Attack Affected versions of this package are vulnerable to Timing Attack due to using inconstant time comparison for CSRF tokens in the UIDL request handler, allowing attackers to guess a security token. How to fix Timing Attack? Upgrade `com.vaadin:flow-server` to version 1.0.14, 2.4.7, 5.0.3 or higher.	[,1.0.14)[1.1.0,2.4.7)[3.0.0,5.0.3)

Vulnerability

Vulnerable Version

Debug Messages Revealing Unnecessary Information

Affected versions of this package are vulnerable to Debug Messages Revealing Unnecessary Information in rpc/PublishedServerEventHandlerRpcHandler.java. Class and method names can be included in RPC responses when processing modified requests.

How to fix Debug Messages Revealing Unnecessary Information?

Upgrade com.vaadin:flow-server to version 1.0.21, 2.9.3, 9.1.2, 23.3.13, 24.0.9, 24.1.0 or higher.

[1.0.0,1.0.21)[1.1.0,2.9.3)[3.0.0,9.1.2)[23.0.0,23.3.13)[24.0.0,24.0.9)[24.1.0.alpha1,24.1.0)

Information Exposure

Affected versions of this package are vulnerable to Information Exposure when adding non-visible components to the UI in the server side.

How to fix Information Exposure?

Upgrade com.vaadin:flow-server to version 1.0.20, 2.8.10, 9.1.1, 23.3.11, 24.0.8, 24.1.0 or higher.

[1.0.0,1.0.20)[1.1.0,2.8.10)[3.0.0,9.1.1)[23.0.0,23.3.11)[24.0.0,24.0.8)[24.1.0.alpha1,24.1.0)

Cross-site Scripting (XSS)

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). URL encoding error in development mode handler allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

How to fix Cross-site Scripting (XSS)?

Upgrade com.vaadin:flow-server to version 2.6.2, 6.0.10 or higher.

[2.0.0,2.6.2)[3.0.0,6.0.10)

Denial of Service (DoS)

Affected versions of this package are vulnerable to Denial of Service (DoS). Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for NotFoundException is provided.

How to fix Denial of Service (DoS)?

Upgrade com.vaadin:flow-server to version 1.0.15, 2.6.2, 6.0.10 or higher.

[1.0.0,1.0.15)[1.1.0,2.6.2)[3.0.0,6.0.10)

Insecure Permissions

Affected versions of this package are vulnerable to Insecure Permissions. Insecure temporary directory usage in frontend build functionality allows local users to inject malicious code into frontend resources during application rebuilds.

How to fix Insecure Permissions?

Upgrade com.vaadin:flow-server to version 6.0.6, 2.5.3 or higher.

[3.0.0,6.0.6)[2.0.9,2.5.3)

Information Exposure

Affected versions of this package are vulnerable to Information Exposure. Insecure configuration of default ObjectMapper may expose sensitive data if the application also uses e.g. @RestController

How to fix Information Exposure?

Upgrade com.vaadin:flow-server to version 3.0.6 or higher.

[3.0.0,3.0.6)

Timing Attack

Affected versions of this package are vulnerable to Timing Attack. Non-constant-time comparison of CSRF tokens in endpoint request handler allows an attacker to guess a security token for Fusion endpoints via timing attack.

How to fix Timing Attack?

Upgrade com.vaadin:flow-server to version 5.0.4 or higher.

[3.0.0,5.0.4)

Directory Traversal

Affected versions of this package are vulnerable to Directory Traversal. Improper URL validation in development mode handler allows attackers to request arbitrary files stored outside of intended frontend resources folder.

How to fix Directory Traversal?

Upgrade com.vaadin:flow-server to version 5.0.0, 2.4.2 or higher.

[3.0.0,5.0.0)[2.0.0,2.4.2)

Timing Attack

Affected versions of this package are vulnerable to Timing Attack due to using inconstant time comparison for CSRF tokens in the UIDL request handler, allowing attackers to guess a security token.

How to fix Timing Attack?

Upgrade com.vaadin:flow-server to version 1.0.14, 2.4.7, 5.0.3 or higher.

[,1.0.14)[1.1.0,2.4.7)[3.0.0,5.0.3)

com.vaadin:flow-server@3.0.3 vulnerabilities

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package manager

Direct Vulnerabilities

How to fix?