URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| com.vaadin:vaadin-bom(Maven) | 14.0.0 | 14.6.2 | N/A |
| com.vaadin:vaadin-bom(Maven) | 15.0.0 | 19.0.9 | N/A |
CVSS Metrics
