| Package | Affected versions | Patched versions |
|---|---|---|
| com.vaadin:vaadin-bom | ≥ 14.0.0, < 14.4.5 | 14.4.5 |
| org.webjars.bowergithub.vaadin:vaadin-menu-bar | ≥ 1.0.0, < 1.2.1 | 1.2.1 |
| vaadin | ≥ 14.0.0, ≤ 14.4.4 | |
| vaadin-menu-bar | ≥ 1.0.0, ≤ 1.2.0 |
Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free