GHSA-j9wr-49vq-rm5g Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19
Attackers can access server-side application classes and resources via crafted HTTP requests in Vaadin OSGi integrations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-j9wr-49vq-rm5g?
GHSA-j9wr-49vq-rm5g is a vulnerability in com.vaadin:vaadin-bom, published on 19 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.
Which versions are affected by GHSA-j9wr-49vq-rm5g?
4 open source packages ship an affected version, including com.vaadin:vaadin-bom.
| Package | Affected | Fixed in |
|---|---|---|
com.vaadin:vaadin-bom Maven | From 12.0.0 | 14.4.10 |
com.vaadin:vaadin-bom Maven | From 12.0.0 | 14.4.10 |
com.vaadin:vaadin-bom Maven | From 19.0.0 | 19.0.1 |
com.vaadin:vaadin-bom Maven | From 19.0.0 | 19.0.1 |
How do I fix GHSA-j9wr-49vq-rm5g?
Upgrade com.vaadin:vaadin-bom to a fixed version for your release line: 14.4.10 or 19.0.1.
Is GHSA-j9wr-49vq-rm5g being exploited?
There is no known exploitation of GHSA-j9wr-49vq-rm5g in the wild and no public exploit code.