GHSA-76f4-fw33-6j2v Potential sensitive data exposure in applications using Vaadin 15
Insecure default configuration in Vaadin flow-server may expose sensitive data to attackers when used with REST controllers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-76f4-fw33-6j2v?
GHSA-76f4-fw33-6j2v is a vulnerability in com.vaadin:vaadin-bom, published on 19 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. @RestController
Which versions are affected by GHSA-76f4-fw33-6j2v?
2 open source packages ship an affected version, including com.vaadin:vaadin-bom.
| Package | Affected | Fixed in |
|---|---|---|
com.vaadin:vaadin-bom Maven | From 15.0.0 | 15.0.5 |
com.vaadin:vaadin-bom Maven | From 15.0.0 | 15.0.5 |
How do I fix GHSA-76f4-fw33-6j2v?
Upgrade com.vaadin:vaadin-bom to 15.0.5 or later.
Is GHSA-76f4-fw33-6j2v being exploited?
There is no known exploitation of GHSA-76f4-fw33-6j2v in the wild and no public exploit code.