com.github.mcollovati.vertx:vertx-vaadin-flow (>=14.4.0, <=14.4.1), com.mantledillusion.vaadin:cotton (>=2.1.0.beta1, <=2.3.4) +37 more potentially affected by CVE-2021-33605 via com.vaadin:vaadin-checkbox-flow (>=14.5.0, <=14.6.7)

com.vaadin:vaadin-checkbox-flow MAVEN version =14.5.0, =14.4.0, =2.1.0.beta1, =1.0.1, =14.5.0, =14.5.0, =14.5.0, =14.5.0, =14.5.0, =14.5.0, =14.5.0, =14.5.0, =14.5.0, =14.5.0, =14.5.0, =14.6.7 and more Source cves: CVE-2021-33605 Source advisory: OSV:GHSA-QCC4-3RXF-GF4M...

com.alibaba.rsocket:alibaba-broker-server (>=1.0.1, <=1.1.1), com.github.mcollovati.vertx:vertx-vaadin-flow (>=18.0.0, <=20.0.0) +19 more potentially affected by CVE-2021-33605 via com.vaadin:vaadin-checkbox-flow (>=18.0.0, <=20.0.5)

com.vaadin:vaadin-checkbox-flow MAVEN version =18.0.0, =1.0.1, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =20.0.5 and more Source cves: CVE-2021-33605 Source advisory: OSV:GHSA-QCC4-3RXF-GF4M...

com.alibaba.rsocket:alibaba-broker-server (>=1.0.1, <=1.1.1), com.github.mcollovati.vertx:vertx-vaadin-flow (>=18.0.0, <=20.0.0) +19 more potentially affected by CVE-2021-33605 via com.vaadin:vaadin-checkbox-flow (>=18.0.0, <=20.0.5)

com.vaadin:vaadin-checkbox-flow MAVEN version =18.0.0, =1.0.1, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =20.0.5 and more Source cves: CVE-2021-33605 Source advisory: GHSA-QCC4-3RXF-GF4M...

Privilege Escalation

vaadin-checkbox-flow is vulnerable to privilege escalation. Insecure validation of CheckboxGroup values allow an attacker to modify the value of a disabled Checkbox inside enabled CheckboxGroup component via unspecified vectors...

com.github.mcollovati.vertx:vertx-vaadin-flow (>=14.4.0, <=14.4.1), com.mantledillusion.vaadin:cotton (>=2.1.0.beta1, <=2.3.4) +37 more potentially affected by CVE-2021-33605 via com.vaadin:vaadin-checkbox-flow (>=14.5.0, <=14.6.7)

com.vaadin:vaadin-checkbox-flow MAVEN version =14.5.0, =14.4.0, =2.1.0.beta1, =1.0.1, =14.5.0, =14.5.0, =14.5.0, =14.5.0, =14.5.0, =14.5.0, =14.5.0, =14.5.0, =14.5.0, =14.5.0, =14.5.0, =14.6.7 and more Source cves: CVE-2021-33605 Source advisory: MEND:CVE-2021-33605...

CVE-2021-33605

CVE-2021-33605 affects com.vaadin:vaadin-checkbox-flow across multiple versions (1.2.0–2.0.0 for Vaadin 12–14, 2.0.0–3.0.0 for Vaadin 14, 3.0.0–4.0.1 for Vaadin 15–17, 14.5.0–14.6.7, 18.0.0–20.0.5). Root cause: improper check in CheckboxGroup permits modifying the value of a disabled Checkbox ins...

com.alibaba.rsocket:alibaba-broker-server (>=1.0.1, <=1.1.1), com.github.mcollovati.vertx:vertx-vaadin-flow (>=18.0.0, <=20.0.0) +19 more potentially affected by CVE-2021-33605 via com.vaadin:vaadin-checkbox-flow (>=18.0.0, <=20.0.5)

com.vaadin:vaadin-checkbox-flow MAVEN version =18.0.0, =1.0.1, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =18.0.0, =20.0.5 and more Source cves: CVE-2021-33605 Source advisory: MEND:CVE-2021-33605...

CVE-2021-33605

Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 Vaadin 12.0.0 prior to 14.0.0, 2.0.0 prior to 3.0.0 Vaadin 14.0.0 prior to 14.5.0, 3.0.0 through 4.0.1 Vaadin 15.0.0 through 17.0.11, 14.5.0 through 14.6.7 Vaadin 14.5.0 through 14.6.7, and 18.0.0...

PT-2021-20229

Name of the Vulnerable Software and Affected Versions com.vaadin:vaadin-checkbox-flow versions 1.2.0 through 2.0.0 com.vaadin:vaadin-checkbox-flow versions 2.0.0 through 3.0.0 com.vaadin:vaadin-checkbox-flow versions 3.0.0 through 4.0.1 com.vaadin:vaadin-checkbox-flow versions 14.5.0 through 14.6...

CVE-2021-33605: Improper Check for Unusual or Exceptional Conditions

Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 Vaadin 12.0.0 prior to 14.0.0, 2.0.0 prior to 3.0.0 Vaadin 14.0.0 prior to 14.5.0, 3.0.0 through 4.0.1 Vaadin 15.0.0 through 17.0.11, 14.5.0 through 14.6.7 Vaadin 14.5.0 through 14.6.7, and 18.0.0...