CVE-2021-33609

Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.

Published: Oct 13, 2021
Updated: May 9, 2024
CVE: CVE-2021-33609
GHSA: GHSA-qcgx-crrx-38v5
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.3
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CVSS v2:

Severity: Low
Score: 4
AV:N/AC:L/Au:S/C:N/I:N/A:P

CWEs:

CWE-20
CWE-400

Affected Software
References

Software	From	Fixed in
vaadin / vaadin	8.0.0	8.14.1
com.vaadin / vaadin-bom	8.0.0	8.14.1

https://github.com/vaadin/framework/pull/12415
https://github.com/vaadin/framework/security/advisories/GHSA-qcgx-crrx-38v5
https://vaadin.com/security/cve-2021-33609

Vulnerability Database

291,049

CVE-2021-33609