CVE-2018-25007

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

Published: Apr 23, 2021
Updated: Nov 9, 2025
CVE: CVE-2018-25007
GHSA: GHSA-jmx8-355m-8vwh
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 2.6
AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

CVSS v2:

Severity: Low
Score: 4
AV:N/AC:L/Au:S/C:N/I:P/A:N

CWEs:

CWE-754

Affected Software
References

Software	From	Fixed in
vaadin / flow	1.0.0	1.0.6
vaadin / vaadin	10.0.0	10.0.8
vaadin / vaadin	11.0.0	11.0.3
com.vaadin / flow-server	1.0.0	1.0.6

https://github.com/vaadin/flow/pull/4774
https://github.com/vaadin/flow/security/advisories/GHSA-jmx8-355m-8vwh
https://vaadin.com/security/cve-2018-25007

Vulnerability Database

CVE-2018-25007

Deep Security Visibility Without the Complexity