GMS-2021-64: Potential sensitive data exposure in applications using Vaadin 15

April 19, 2021 (updated October 8, 2021)

Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. @RestController

https://vaadin.com/security/cve-2020-36319

References

github.com/advisories/GHSA-76f4-fw33-6j2v
github.com/vaadin/platform/security/advisories/GHSA-76f4-fw33-6j2v
vaadin.com/security/cve-2020-36319

Code Behaviors & Features

Detect and mitigate GMS-2021-64 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →