CVE-2018-25007: Improper Check for Unusual or Exceptional Conditions

April 19, 2021 (updated April 26, 2021)

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

References

github.com/advisories/GHSA-jmx8-355m-8vwh
github.com/vaadin/flow/pull/4774
github.com/vaadin/flow/security/advisories/GHSA-jmx8-355m-8vwh
nvd.nist.gov/vuln/detail/CVE-2018-25007
vaadin.com/security/cve-2018-25007

Code Behaviors & Features

Detect and mitigate CVE-2018-25007 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →