CVE-2020-36319 Potential sensitive data exposure in applications using Vaadin 15
Insecure default ObjectMapper configuration in Vaadin flow-server may expose sensitive data in applications using RestControllers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-36319?
CVE-2020-36319 is a low-severity vulnerability in Vaadin, published on 23 Apr 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. @RestController
Which versions are affected by CVE-2020-36319?
2 open source packages ship an affected version, including com.vaadin:flow-server. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
com.vaadin:flow-server Maven | From 3.0.0 | 3.0.6 |
com.vaadin:flow-server Maven | From 3.0.0 | 3.0.6 |
Products include Vaadin Flow, Vaadin Vaadin.
How do I fix CVE-2020-36319?
Upgrade com.vaadin:flow-server to 3.0.6 or later.
Is CVE-2020-36319 being exploited?
There is no known exploitation of CVE-2020-36319 in the wild and no public exploit code.
Other vulnerabilities in Vaadin
- CVE-2021-31407 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19
- CVE-2021-31405 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
- CVE-2021-31411 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19
- CVE-2021-31408 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
- CVE-2019-25027 Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
Sources
Also known as GHSA-rjww-2x8v-m9v9.