Cross-site scripting in Action caption
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 7.7.50, 8.30.0, 23.6.6, 24.8.14, 24.9.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from user input. In Vaadin Framework 7 and 8, the Action class is a general-purpose class that may be used by multiple components. The fixed versions sanitize captions by default and provide an API to explicitly enable HTML content mode for backwards compatibility. In Vaadin 23 and newer, the Action class is only used by the Spreadsheet component. The fixed versions sanitize HTML using Jsoup with a relaxed safelist. Vaadin 14 is not affected as Spreadsheet component was not supported. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 7.0.0 - 7.7.49 Vaadin 8.0.0 - 8.29.1 Vaadin 23.1.0 - 23.6.5 Vaadin 24.0.0 - 24.8.13 Vaadin 24.9.0 - 24.9.6 Mitigation Upgrade to 7.7.50 Upgrade to 8.30.0 Upgrade to 23.6.6 Upgrade to 24.8.14 or 24.9.7 Upgrade to 25.0.0 or newer Artifacts Maven coordinatesVulnerable versionsFixed versioncom.vaadin:vaadin-server 7.0.0 - 7.7.49 ≥7.7.50 com.vaadin:vaadin-server 8.0.0 - 8.29.1 ≥8.30.0 com.vaadin:vaadin 23.1.0 - 23.6.5 ≥23.6.6 com.vaadin:vaadin24.0.0 - 24.8.13 ≥24.8.14 com.vaadin:vaadin24.9.0 - 24.9.6 ≥24.9.7 com.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.5 ≥23.6.6 com.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.8.13 ≥24.8.14 com.vaadin:vaadin-spreadsheet-flow 24.9.0 - 24.9.6 ≥24.9.7
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- com.vaadin:vaadin
From 23.1.0 · through 23.6.5; From 24.0.0 · through 24.8.13; From 24.9.0 · through 24.9.6
- com.vaadin:vaadin-server
From 7.0.0 · through 7.7.49; From 8.0.0 · through 8.29.1
- com.vaadin:vaadin-spreadsheet-flow
From 23.1.0 · through 23.6.5; From 24.0.0 · through 24.8.13; From 24.9.0 · through 24.9.6
- com.vaadin:vaadin-serverMaven
From 7.0.0 · fixed in 7.7.50
- com.vaadin:vaadin-serverMaven
From 8.0.0 · fixed in 8.30.0
- com.vaadin:vaadinMaven
From 23.1.0 · fixed in 23.6.6
- com.vaadin:vaadinMaven
From 24.0.0 · fixed in 24.8.14
- com.vaadin:vaadinMaven
From 24.9.0 · fixed in 24.9.7
- com.vaadin:vaadin-spreadsheet-flowMaven
From 23.1.0 · fixed in 23.6.6
- com.vaadin:vaadin-spreadsheet-flowMaven
From 24.0.0 · fixed in 24.8.14
- com.vaadin:vaadin-spreadsheet-flowMaven
From 24.9.0 · fixed in 24.9.7