CVE-2019-25027: Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

Q: What is the severity of CVE-2019-25027?

CVE-2019-25027 is considered a medium severity vulnerability due to its impact on web applications using Vaadin frameworks.

Q: How do I fix CVE-2019-25027?

To fix CVE-2019-25027, it is recommended to update Vaadin Flow to versions 1.0.11, 1.4.3, or higher for affected releases.

Q: What types of attacks can CVE-2019-25027 enable?

CVE-2019-25027 can enable cross-site scripting (XSS) attacks through the execution of malicious JavaScript in the default RouteNotFoundError view.

Q: Which versions of Vaadin are affected by CVE-2019-25027?

CVE-2019-25027 affects Vaadin Flow versions 1.0.0 through 1.0.10, 1.1.0 through 1.4.2, and 10.0.0 through 13.0.5.

Q: What is the main vulnerability in CVE-2019-25027?

The main vulnerability in CVE-2019-25027 is the missing output sanitization in the default RouteNotFoundError view.

Published Apr 23, 2021

Updated

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL

Affected Software

4 affected components

Vaadin flow>=1.0.0<1.0.11

Vaadin flow>=1.1.0<1.4.3

Vaadin Vaadin>=10.0.0<10.0.14

Vaadin Vaadin>=11.0.0<13.0.6

Remediation

Patch Available

https://github.com/vaadin/flow/pull/5498

Event History

Apr 23, 2021

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2019-25027?

CVE-2019-25027 is considered a medium severity vulnerability due to its impact on web applications using Vaadin frameworks.

How do I fix CVE-2019-25027?

To fix CVE-2019-25027, it is recommended to update Vaadin Flow to versions 1.0.11, 1.4.3, or higher for affected releases.

What types of attacks can CVE-2019-25027 enable?