CVE-2021-31411CWE-379

Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19

Medium · published May 5, 2021

CVSS v3.1
6.3
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to inject malicious code into frontend resources during application rebuilds.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00231 · 13.2th percentile
Weakness
CWE-379 · Creation of Temporary File in Directory with Insecure Permissions
Published
2021-05-05T18:15Z
EPSS history
Timeline
  • 05 MAY 18:15Z
    Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19
    cvelistv5