CVE-2020-36319

Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. @RestController

Published: Apr 23, 2021
Updated: May 9, 2024
CVE: CVE-2020-36319
GHSA: GHSA-rjww-2x8v-m9v9
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 6.5
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

Severity: Low
Score: 3.5
AV:N/AC:M/Au:S/C:P/I:N/A:N

CWEs:

CWE-200
CWE-668

Affected Software
References

Software	From	Fixed in
vaadin / flow	3.0.0	3.0.6
vaadin / vaadin	15.0.0	15.0.5
com.vaadin / flow-server	3.0.0	3.0.6

https://github.com/vaadin/flow/pull/8016
https://github.com/vaadin/flow/pull/8051
https://github.com/vaadin/flow/security/advisories/GHSA-rjww-2x8v-m9v9
https://vaadin.com/security/cve-2020-36319

Vulnerability Database

CVE-2020-36319

Deep Security Visibility Without the Complexity