CVE-2018-25007 Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

What is CVE-2018-25007?

CVE-2018-25007 is a low-severity missing authorization vulnerability in Vaadin, published on 23 Apr 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

Weakness: CWE-754

Which versions are affected by CVE-2018-25007?

2 open source packages ship an affected version, including com.vaadin:flow-server. It affects 2 products.

Products include Vaadin Flow, Vaadin Vaadin.

How do I fix CVE-2018-25007?

Upgrade com.vaadin:flow-server to 1.0.6 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2018-25007 being exploited?

There is no known exploitation of CVE-2018-25007 in the wild and no public exploit code.

Other vulnerabilities in Vaadin

• CVE-2021-31407 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 High 8.6
• CVE-2021-31405 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 High 7.5
• CVE-2021-31411 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 Medium 6.3
• CVE-2021-31408 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 Medium 6.3
• CVE-2019-25027 Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jmx8-355m-8vwh.