com.vaadin:vaadin-spreadsheet-flow@25.0.0-beta8

latest version

25.3.4

latest non vulnerable version

25.3.4

first published

4 years ago

latest version published

8 days ago

licenses detected

Unknown
[23.1.0,)

package registry

View on Maven Central Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the com.vaadin:vaadin-spreadsheet-flow package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
M Incorrect Authorization Affected versions of this package are vulnerable to Incorrect Authorization in `SpreadsheetHandlerImpl.updateCellComment()`, which writes the supplied text to the target cell without checking whether the active sheet is protected or the cell locked, unlike the edit, cut, and paste handlers in the same class, which consult `Spreadsheet.isCellLocked()` before writing. A user with access to a rendered spreadsheet can add or alter comments on a protected sheet and on locked cells, and create empty cells by targeting coordinates that hold none, by dispatching the comment update event directly rather than through the UI that withholds it. This requires an authenticated session with a protected spreadsheet rendered to it and no special configuration, and the effect stays within that user's session until the workbook is persisted or shared, at which point the altered comments reach everyone who opens it. How to fix Incorrect Authorization? Upgrade `com.vaadin:vaadin-spreadsheet-flow` to version 23.6.14, 24.9.22, 24.10.10, 25.1.12, 25.2.7 or higher.	[,23.6.14)[24.0.0,24.9.22)[24.10.0-beta1,24.10.10)[25.0.0-beta1,25.1.12)[25.2.0-beta1,25.2.7)

Incorrect Authorization

Affected versions of this package are vulnerable to Incorrect Authorization in SpreadsheetHandlerImpl.updateCellComment(), which writes the supplied text to the target cell without checking whether the active sheet is protected or the cell locked, unlike the edit, cut, and paste handlers in the same class, which consult Spreadsheet.isCellLocked() before writing. A user with access to a rendered spreadsheet can add or alter comments on a protected sheet and on locked cells, and create empty cells by targeting coordinates that hold none, by dispatching the comment update event directly rather than through the UI that withholds it. This requires an authenticated session with a protected spreadsheet rendered to it and no special configuration, and the effect stays within that user's session until the workbook is persisted or shared, at which point the altered comments reach everyone who opens it.

How to fix Incorrect Authorization?

Upgrade com.vaadin:vaadin-spreadsheet-flow to version 23.6.14, 24.9.22, 24.10.10, 25.1.12, 25.2.7 or higher.

[,23.6.14)[24.0.0,24.9.22)[24.10.0-beta1,24.10.10)[25.0.0-beta1,25.1.12)[25.2.0-beta1,25.2.7)

Go back to all versions of this package