Vulnerability	Vulnerable Version
L Permissive Cross-domain Policy with Untrusted Domains com.vaadin:vaadin is a Java framework for modern Java web applications. Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the `push endpoint` reflecting the request Origin into the Access-Control-Allow-Origin response header and allowing credentials. An attacker can access sensitive information by making cross-origin requests with the user's cookies and reading the response. This is only exploitable if the application uses server push and the attacker knows the push identifier of the session. How to fix Permissive Cross-domain Policy with Untrusted Domains? Upgrade `com.vaadin:vaadin` to version 14.14.8, 23.6.17, 24.4.26, 24.7.17, 24.9.24, 24.10.12, 25.2.11, 25.3.3 or higher.	[14.14.0,14.14.8)[23.6.0,23.6.17)[24.4.0,24.4.26)[24.5.0,24.7.17)[24.8.0,24.9.24)[24.10.0,24.10.12)[25.0.0,25.2.11)[25.3.0,25.3.3)

Permissive Cross-domain Policy with Untrusted Domains

com.vaadin:vaadin is a Java framework for modern Java web applications.

Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the push endpoint reflecting the request Origin into the Access-Control-Allow-Origin response header and allowing credentials. An attacker can access sensitive information by making cross-origin requests with the user's cookies and reading the response. This is only exploitable if the application uses server push and the attacker knows the push identifier of the session.

How to fix Permissive Cross-domain Policy with Untrusted Domains?

Upgrade com.vaadin:vaadin to version 14.14.8, 23.6.17, 24.4.26, 24.7.17, 24.9.24, 24.10.12, 25.2.11, 25.3.3 or higher.

[14.14.0,14.14.8)[23.6.0,23.6.17)[24.4.0,24.4.26)[24.5.0,24.7.17)[24.8.0,24.9.24)[24.10.0,24.10.12)[25.0.0,25.2.11)[25.3.0,25.3.3)

Go back to all versions of this package