GHSA-8vfw-v2jv-9hwc: 
Java vulnerability analysis and mitigation

A reflected cross-site scripting vulnerability was discovered in Vaadin's development mode handler, affecting com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1) and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8). The vulnerability, identified as CVE-2021-33604, was published on June 24, 2021, and is characterized by a URL encoding error that allows local users to execute arbitrary JavaScript code by opening crafted URLs in the browser. The vulnerability has been assigned a low severity rating with a CVSS score of 2.5 (Vaadin Security, GitHub Advisory).

The vulnerability stems from improper URL sanitation within the frontend development server, which could allow attackers to perform cross-site scripting attacks from another web page opened by the developer. The vulnerability is classified as CWE-172 (Encoding Error) and has been assigned the CVSS vector string CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, indicating local attack vector, high attack complexity, no privileges required, and required user interaction (Vaadin Security).

The vulnerability only affects applications during development time on a developer's machine and is not exploitable in deployed applications. For successful exploitation, the application must be running with the frontend development server started and contain sensitive data, such as a production database clone. The attacker needs to be aware of the application running on the developer's system, the data it provides, and the Vaadin version it is running on (Vaadin Security).

Users of affected versions are advised to upgrade to patched versions: Vaadin 14.6.2 or newer for versions 14.0.0-14.6.1, and 19.0.9 or newer for versions 19.0.0-19.0.8. Users of Vaadin versions 15-18 should upgrade to version 19.0.9 or newer as these versions are no longer supported. For the Maven artifact com.vaadin:flow-server, users should upgrade to version 2.6.2 or 6.0.10 depending on their current version (Vaadin Security).