VULNERABILITY INTELLIGENCE

CVE-2020-36321

CVSS score5.9 MEDIUM

EPSS probability1.21%

CISA KEVNot currently listed

Published2021-04-23

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder.

Weakness classification

security@vaadin.com: CWE-22
nvd@nist.gov: CWE-22

Primary references

security@vaadin.com — Patch, Third Party Advisory
security@vaadin.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory