CVE-2018-25007: Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-25007?
CVE-2018-25007 is considered a high severity vulnerability due to its potential for abuse in updating element property values.
How do I fix CVE-2018-25007?
To remediate CVE-2018-25007, upgrade to Vaadin Flow version 1.0.6 or higher, or Vaadin 10.0.8 or higher, or Vaadin 11.0.3 or higher.
What versions of Vaadin are affected by CVE-2018-25007?
CVE-2018-25007 affects Vaadin Flow versions 1.0.0 through 1.0.5, and both Vaadin 10.0.0 through 10.0.7 and 11.0.0 through 11.0.2.
What type of vulnerability is CVE-2018-25007?
CVE-2018-25007 is a missing check vulnerability that allows an attacker to exploit the UIDL request handler.
Can CVE-2018-25007 be exploited remotely?
Yes, CVE-2018-25007 can be exploited remotely through crafted synchronization messages.