Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

- https://vaadin.com/security/cve-2018-25007

Affected Packages

Maven com.vaadin:flow-server

Affected versions: 1.0.0 (fixed in 1.0.6)

Related CVEs

CVE-2018-25007

Key Information

GHSA ID

GHSA-jmx8-355m-8vwh

Published

April 19, 2021 2:53 PM

Last Modified

April 16, 2021 11:18 PM

CVSS Score

2.5 /10

Primary Ecosystem

Maven

Primary Package

com.vaadin:flow-server

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 5, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.