Medium severity · published Apr 23, 2021
CVE-2019-25028
Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0…
6.1
CVSS
0.9%
EPSS
No
On KEV
Description
Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
Vaadin · Vaadin
7.4.0 before 7.7.20; 8.0.0 before 8.8.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-25028
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-25028
Patch
https://github.com/vaadin/framework/pull/11644
Patch
https://github.com/vaadin/framework/pull/11645
Vendor Advisory
https://vaadin.com/security/cve-2019-25028
More from Vaadin
8.4
CVE-2026-107588
Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts
7.8
CVE-2021-31411
Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0…
7.5
CVE-2022-29567
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through…
7.5
CVE-2021-31409
Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers…
7.5
CVE-2021-31407
Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to…