CVE-2018-25007

Name of the Vulnerable Software and Affected Versions com.vaadin:flow-server versions 1.0.0 through 1.0.5 Vaadin versions 10.0.0 through 10.0.7 Vaadin versions 11.0.0 through 11.0.2

Description A missing check in the UIDL request handler allows an attacker to update element property values via a crafted synchronization message.

Recommendations For com.vaadin:flow-server versions 1.0.0 through 1.0.5, update to a version outside of the affected range. For Vaadin versions 10.0.0 through 10.0.7, update to a version outside of the affected range. For Vaadin versions 11.0.0 through 11.0.2, update to a version outside of the affected range. As a temporary workaround, consider restricting access to the UIDL request handler until a patch is available.