CVE-2020-36319: 
Java vulnerability analysis and mitigation

CVE-2020-36319 affects Vaadin Flow server versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4). The vulnerability involves an insecure configuration of default ObjectMapper that could potentially expose sensitive data in applications using certain Spring features. The issue was discovered and reported by Christian Knoop, with a CVSS v3.1 base score of 3.1 (Low severity) (Vaadin Security).

The vulnerability stems from the modification of Spring's default ObjectMapper bean to expose private and protected properties. This configuration change affects the com.vaadin:flow-server component and could lead to unintended exposure of sensitive information when used in conjunction with Spring features like @RestController. The vulnerability is classified as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (Vaadin Security).

The vulnerability could result in the exposure of sensitive data if the application uses Spring features like @RestController alongside the affected Vaadin versions. The impact is considered low severity with a CVSS base score of 3.1, requiring network access and low privileges for exploitation (Vaadin Security).

The vulnerability was fixed in Vaadin 15.0.5 (flow-server 3.0.6) by modifying only a separate ObjectMapper instance that isn't shared with other Spring functionality. Users of affected versions (Vaadin 15.0.0 - 15.0.4) should upgrade to version 15.0.5 or newer to mitigate the vulnerability (Vaadin Security).