Insecure configuration of default `ObjectMapper` in `com.vaadin:flow-server` versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. `@RestController`

- https://vaadin.com/security/cve-2020-36319

Affected Packages

Maven com.vaadin:flow-server

Affected versions: 3.0.0 (fixed in 3.0.6)

Related CVEs

CVE-2020-36319

Key Information

GHSA ID

GHSA-rjww-2x8v-m9v9

Published

April 19, 2021 2:52 PM

Last Modified

September 21, 2022 7:31 PM

CVSS Score

2.5 /10

Primary Ecosystem

Maven

Primary Package

com.vaadin:flow-server

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 5, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.