CVE-2019-25028: Stored cross-site scripting in Grid component in Vaadin 7 and 8
Summary
CVE-2019-25028: Stored cross-site scripting in Grid component in Vaadin 7 and 8. Affects com.vaadin:vaadin-bom across 2 version ranges.
>= 7.4.0, < 7.7.20
>= 8.0.0, < 8.8.5
Fixed in 7.7.20 or 8.8.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Vaadin framework is a Java-based open-source framework used for building modern web applications. It provides a set of user interface components, including the Grid component, which is used for displaying tabular data. The Grid component in Vaadin versions 7.4.0 through 7.7.19 and 8.0.0 through 8.8.4 is vulnerable to stored cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from a lack of variable sanitization in the Grid component. An attacker can exploit this vulnerability by injecting malicious JavaScript code through an unspecified vector. This can lead to the execution of arbitrary code in the context of the victim's browser, potentially compromising sensitive user data or performing unauthorized actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.4.0, < 7.7.207.7.20 -
>= 8.0.0, < 8.8.58.8.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize the input data before using it in the Grid component. This can be done by implementing proper input validation and escaping techniques to prevent the execution of malicious code. Here is an example of how to sanitize the input in Java:
String sanitizedInput = StringEscapeUtils.escapeHtml4(input);
Conclusion
The stored cross-site scripting vulnerability in the Grid component of Vaadin versions 7 and 8 can allow attackers to inject malicious JavaScript code, potentially compromising user data and performing unauthorized actions. To mitigate this risk, it is recommended to upgrade to the fixed versions of the Vaadin framework. Developers can also implement input sanitization techniques as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.vaadin:vaadin-bom →
FAQ
The vulnerability allows an attacker to inject malicious JavaScript code, which can lead to various consequences such as stealing sensitive user information, performing unauthorized actions on behalf of the user, or defacing the application.
No, only Vaadin versions 7.4.0 through 7.7.19 and 8.0.0 through 8.8.4 are affected. It is recommended to check the version of Vaadin used in your application and apply the necessary updates.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is important to apply the recommended fixes to mitigate the risk of potential attacks.
Yes, this vulnerability can be exploited remotely. An attacker can inject the malicious code through a web interface, and the code will be executed in the victim's browser when they interact with the affected Grid component.
Yes, the CVSS score for this vulnerability is 5.4, indicating a moderate severity level. It is important to address this vulnerability to prevent potential security breaches.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.vaadin:vaadin-bom.
