GMS-2021-63: Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

April 19, 2021 (updated October 8, 2021)

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

https://vaadin.com/security/cve-2018-25007

References

github.com/advisories/GHSA-3h5r-928v-mxhh
github.com/vaadin/platform/security/advisories/GHSA-3h5r-928v-mxhh
vaadin.com/security/cve-2018-25007

Code Behaviors & Features

Detect and mitigate GMS-2021-63 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →