CVE-2021-33611

MEDIUM6.1EPSS 0.30%

Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14

Published: 11/3/2021Modified: 11/8/2023

Description

Missing output sanitization in test sources in `org.webjars.bowergithub.vaadin:vaadin-menu-bar` versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL.

Affected packages (2)

Maven/com.vaadin:vaadin-bom>= 14.0.0, < 14.4.5
Maven/org.webjars.bowergithub.vaadin:vaadin-menu-bar>= 1.0.0, < 1.2.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-33611
PATCHhttps://github.com/vaadin/platform
WEBhttps://github.com/vaadin/platform/security/advisories/GHSA-93c4-vf86-3rj7
WEBhttps://github.com/vaadin/vaadin-menu-bar/pull/126
WEBhttps://vaadin.com/security/cve-2021-33611