{"id":"GHSA-j9wr-49vq-rm5g","aliases":[],"url":"https://o3.security/vulnerability/GHSA-j9wr-49vq-rm5g","summary":"Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19","details":"Vulnerability in OSGi integration in `com.vaadin:flow-server` versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.\n\n- https://vaadin.com/security/cve-2021-31407","published":"2021-04-19T14:46:49Z","modified":"2024-12-02T05:48:18.341658Z","cvss":{"score":8.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"com.vaadin:vaadin-bom","fixedVersion":"14.4.10"},{"ecosystem":"Maven","name":"com.vaadin:vaadin-bom","fixedVersion":"19.0.1"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/vaadin/platform/security/advisories/GHSA-j9wr-49vq-rm5g"},{"type":"PACKAGE","url":"https://github.com/vaadin/platform"},{"type":"WEB","url":"https://vaadin.com/security/cve-2021-31407"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-12-02T05:48:18.341658Z"}}