ByteOS Network

Vulnerability Details :

CVE-2018-25007

Assigner-Vaadin

Assigner Org ID-9e0f3122-90e9-42d5-93de-8c6b98deef7e

Published At-23 Apr, 2021 | 16:05

Updated At-16 Sep, 2024 | 18:18

Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:Vaadin

Assigner Org ID:9e0f3122-90e9-42d5-93de-8c6b98deef7e

Published At:23 Apr, 2021 | 16:05

Updated At:16 Sep, 2024 | 18:18

▼CVE Numbering Authority (CNA)

Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

Affected Products

Vendor

Vaadin

Product

Vaadin

Versions

Affected

From 10.0.0 before * (custom)
- -> affectedfrom11.0.0

Vendor

Vaadin

Product

flow-server

Versions

Affected

From 1.0.0 before * (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-754	CWE-754 Improper Check for Unusual or Exceptional Conditions

Type: CWE

CWE ID: CWE-754

Description: CWE-754 Improper Check for Unusual or Exceptional Conditions

Metrics

Version	Base score	Base severity	Vector
3.1	2.6	LOW	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Version: 3.1

Base score: 2.6

Base severity: LOW

Vector:

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

References

Hyperlink	Resource
https://vaadin.com/security/cve-2018-25007	x_refsource_MISC
https://github.com/vaadin/flow/pull/4774	x_refsource_MISC

Hyperlink: https://vaadin.com/security/cve-2018-25007

Resource:

x_refsource_MISC

Hyperlink: https://github.com/vaadin/flow/pull/4774

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://vaadin.com/security/cve-2018-25007	x_refsource_MISC x_transferred
https://github.com/vaadin/flow/pull/4774	x_refsource_MISC x_transferred

Hyperlink: https://vaadin.com/security/cve-2018-25007

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://github.com/vaadin/flow/pull/4774

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security@vaadin.com

Published At:23 Apr, 2021 | 16:15

Updated At:05 May, 2021 | 18:26

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Secondary	3.1	2.6	LOW	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Primary	2.0	4.0	MEDIUM	AV:N/AC:L/Au:S/C:N/I:P/A:N

Type: Primary

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 2.6

Base severity: LOW

Vector:

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Type: Primary

Version: 2.0

Base score: 4.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:S/C:N/I:P/A:N

CPE Matches

vaadin>>flow>>Versions from 1.0.0(inclusive) to 1.0.6(exclusive)

cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*

vaadin>>vaadin>>Versions from 10.0.0(inclusive) to 10.0.8(exclusive)

cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*

vaadin>>vaadin>>Versions from 11.0.0(inclusive) to 11.0.3(exclusive)

cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-754	Primary	nvd@nist.gov
CWE-754	Secondary	security@vaadin.com

CWE ID: CWE-754

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-754

Type: Secondary

Source: security@vaadin.com

References

Hyperlink	Source	Resource
https://github.com/vaadin/flow/pull/4774	security@vaadin.com	Patch Third Party Advisory
https://vaadin.com/security/cve-2018-25007	security@vaadin.com	Vendor Advisory

Hyperlink: https://github.com/vaadin/flow/pull/4774

Source: security@vaadin.com

Resource:

Patch

Third Party Advisory

Hyperlink: https://vaadin.com/security/cve-2018-25007

Source: security@vaadin.com

Resource:

Vendor Advisory

Similar CVEs

4Records found

CVE-2021-33605

Matching Score-10

Assigner-Vaadin Ltd.

View Details

Matching Score-10

Assigner-Vaadin Ltd.

CVSS Score-4.3||MEDIUM

EPSS-0.23% / 45.81%

7 Day CHG~0.00%

Published-25 Aug, 2021 | 12:12

Updated-17 Sep, 2024 | 02:53

Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20

Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled Checkbox inside enabled CheckboxGroup component via unspecified vectors.

Vendor-vaadin Vaadin

Product-vaadin-checkbox-flow vaadin vaadin-checkbox-flow Vaadin

CWE ID-CWE-754

Improper Check for Unusual or Exceptional Conditions

CVE-2023-45922

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.06% / 19.31%

7 Day CHG~0.00%

Published-27 Mar, 2024 | 00:00

Updated-05 Jun, 2025 | 15:21

glx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation violation when calling __glXGetDrawableAttribute(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.

Vendor-mesa3d n/a

Product-mesa n/a

CWE ID-CWE-754

Improper Check for Unusual or Exceptional Conditions

CVE-2023-6742

Matching Score-4

Assigner-Wordfence

View Details

Matching Score-4

Assigner-Wordfence

CVSS Score-4.3||MEDIUM

EPSS-0.16% / 37.34%

7 Day CHG~0.00%

Published-11 Jan, 2024 | 08:32

Updated-17 Jun, 2025 | 20:00

The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'envira_gallery_insert_images' function in all versions up to, and including, 1.8.7.1. This makes it possible for authenticated attackers, with contributor access and above, to modify galleries on other users' posts.

Vendor-Awesome Motive Inc.Envira Gallery, LLC (Envira Gallery)

Product-envira_gallery Gallery Plugin for WordPress – Envira Photo Gallery

CWE ID-CWE-754

Improper Check for Unusual or Exceptional Conditions

CVE-2023-39205

Matching Score-4

Assigner-Zoom Video Communications, Inc.

View Details

Matching Score-4

Assigner-Zoom Video Communications, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.37% / 57.95%

7 Day CHG~0.00%

Published-14 Nov, 2023 | 22:32

Updated-29 Aug, 2024 | 15:20

Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of service via network access.

Vendor-Zoom Communications, Inc.

Product-virtual_desktop_infrastructure video_software_development_kit meetings zoom Zoom Clients

CWE ID-CWE-754

Improper Check for Unusual or Exceptional Conditions

CVE-2018-25007

Credits

Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs