Directory traversal in development mode handler in Vaadin 14 and 15-17

CVE-2020-36321 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder.

  • https://vaadin.com/security/cve-2020-36321

Basic information

Type
reviewed
Severity
medium
Advisory on GitHub
Open advisory ↗
Repository advisory
Open repository advisory ↗
Source code
Not specified
Published (advisory)
2021-04-19 14:51:58 UTC
Updated
2023-02-01 05:05:36 UTC
GitHub reviewed
2021-04-16 23:16:25 UTC
NVD published
2021-04-23

EPSS Score

Score Percentile
0.55% 67.50%

CVSS Scores

Base score Version Severity Vector
5.9 3.1 —
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:N)
Service keeps running; no real outage angle.

Identifiers

Type Value
GHSA GHSA-49r2-73m6-pp8f ↗
CVE CVE-2020-36321 ↗

CWEs

CWE id Name
CWE-20 Improper Input Validation
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected packages (2)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
maven com.vaadin:flow-server >= 3.0.0, < 5.0.0 5.0.0 —
maven com.vaadin:flow-server >= 2.0.0, < 2.4.2 2.4.2 —

References

cvelogic Threat Intelligence