CVE-2021-33604: Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19

Published Jun 24, 2021
·
Updated

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

Affected Software

6 affected components
Vaadin flow-server>=2.0.0<=2.6.1
Vaadin flow-server>=3.0.0<=5.0.0
Vaadin flow-server>=6.0.0<=6.0.9
Vaadin Vaadin>=14.0.0<=14.6.1
Vaadin Vaadin>=15.0.0<=18.0.0
Vaadin Vaadin>=19.0.0<=19.0.8

Event History

Jun 24, 2021
CVE Published
via MITRE·11:16 AM
Data Sourced
via MITRE·11:16 AM
DescriptionSeverityWeakness
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the vulnerability CVE-2021-33604?

CVE-2021-33604 is a URL encoding error in the development mode handler of Vaadin Flow that allows local users to execute arbitrary JavaScript code via crafted URLs.

2

What is the severity of CVE-2021-33604?

CVE-2021-33604 has a high severity rating due to its potential to allow script injection and unauthorized code execution.

3

How do I fix CVE-2021-33604?

To fix CVE-2021-33604, update your Vaadin Flow Server version to a secure release that is above the vulnerable versions.

4

Which versions are affected by CVE-2021-33604?

CVE-2021-33604 affects Vaadin Flow versions 2.0.0 through 2.6.1 and 3.0.0 through 6.0.9, as well as Vaadin versions from 14.0.0 through 19.0.8.

5

Who is impacted by CVE-2021-33604?

Developers and users running affected versions of Vaadin Flow in development environments are impacted by CVE-2021-33604.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203