VULNERABILITY INTELLIGENCE

CVE-2021-33604

CVSS score2.5 LOW

EPSS probability0.29%

CISA KEVNot currently listed

Published2021-06-24

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Description

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

Weakness classification

security@vaadin.com: CWE-172
nvd@nist.gov: NVD-CWE-Other

Primary references

security@vaadin.com — Patch, Third Party Advisory
security@vaadin.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory