Stored cross-site scripting in Grid component in Vaadin 7 and 8

2021-04-1914:49:48

Google

osv.dev

0.001 Low

EPSS

Percentile

41.4%

JSON

Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector.

https://vaadin.com/security/cve-2019-25028

CPENameOperatorVersion
com.vaadin:vaadin-bomeq8.0.2
com.vaadin:vaadin-servereq7.7.13
com.vaadin:vaadin-bomeq7.6.3
com.vaadin:vaadin-servereq8.8.4
com.vaadin:vaadin-bomeq8.7.2
com.vaadin:vaadin-servereq7.5.4
com.vaadin:vaadin-servereq8.7.1
com.vaadin:vaadin-bomeq8.3.0
com.vaadin:vaadin-servereq7.5.9
com.vaadin:vaadin-bomeq7.7.17

Name	Operator	Version
com.vaadin:vaadin-bom	eq	8.0.2
com.vaadin:vaadin-server	eq	7.7.13
com.vaadin:vaadin-bom	eq	7.6.3
com.vaadin:vaadin-server	eq	8.8.4
com.vaadin:vaadin-bom	eq	8.7.2
com.vaadin:vaadin-server	eq	7.5.4
com.vaadin:vaadin-server	eq	8.7.1
com.vaadin:vaadin-bom	eq	8.3.0
com.vaadin:vaadin-server	eq	7.5.9
com.vaadin:vaadin-bom	eq	7.7.17