[MAVEN:GHSA-Q74R-4XW3-PPX9] Stored cross-site scripting in Grid component in Vaadin 7 and 8

Severity Moderate

Affected Packages 4

Fixed Packages 4

CVEs 1

Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector.

https://vaadin.com/security/cve-2019-25028

Package	Affected Version
pkg:maven/com.vaadin/vaadin-server	>= 8.0.0, < 8.8.5
pkg:maven/com.vaadin/vaadin-server	>= 7.4.0, < 7.7.20
pkg:maven/com.vaadin/vaadin-bom	>= 8.0.0, < 8.8.5
pkg:maven/com.vaadin/vaadin-bom	>= 7.4.0, < 7.7.20

Package	Fixed Version
pkg:maven/com.vaadin/vaadin-server	= 8.8.5
pkg:maven/com.vaadin/vaadin-server	= 7.7.20
pkg:maven/com.vaadin/vaadin-bom	= 8.8.5
pkg:maven/com.vaadin/vaadin-bom	= 7.7.20

ID: MAVEN:GHSA-Q74R-4XW3-PPX9
Severity: moderate
URL: https://github.com/advisories/GHSA-q74r-4xw3-ppx9
Published: 2021-04-19T14:49:48
(3 years ago)
Modified: 2023-02-01T05:05:25
(19 months ago)
Rights: Maven Security Team

Source	# ID	Name	URL
			https://github.com/vaadin/framework/security/advisories/GHSA-q74r-4xw3-ppx9
			https://vaadin.com/security/cve-2019-25028
			https://nvd.nist.gov/vuln/detail/CVE-2019-25028
			https://github.com/vaadin/framework/pull/11644
			https://github.com/vaadin/framework/pull/11645
			https://github.com/advisories/GHSA-q74r-4xw3-ppx9

Type	Package URL	Namespace	Name / Product	Version
Affected	pkg:maven/com.vaadin/vaadin-server	com.vaadin	vaadin-server	>= 8.0.0 < 8.8.5
Fixed	pkg:maven/com.vaadin/vaadin-server	com.vaadin	vaadin-server	= 8.8.5
Affected	pkg:maven/com.vaadin/vaadin-server	com.vaadin	vaadin-server	>= 7.4.0 < 7.7.20
Fixed	pkg:maven/com.vaadin/vaadin-server	com.vaadin	vaadin-server	= 7.7.20
Affected	pkg:maven/com.vaadin/vaadin-bom	com.vaadin	vaadin-bom	>= 8.0.0 < 8.8.5
Fixed	pkg:maven/com.vaadin/vaadin-bom	com.vaadin	vaadin-bom	= 8.8.5
Affected	pkg:maven/com.vaadin/vaadin-bom	com.vaadin	vaadin-bom	>= 7.4.0 < 7.7.20
Fixed	pkg:maven/com.vaadin/vaadin-bom	com.vaadin	vaadin-bom	= 7.7.20

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date