title: Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19
description: Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.
problem types: CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak')
affected:
{
product: Vaadin
vendor: Vaadin
versions:
status: affected, version: 19.0.0
lessThan: *, status: affected, version: 12.0.0, versionType: custom
}
{
product: flow-server
vendor: Vaadin
versions:
changes: [at: 6.0.0, status: affected], lessThan: *, status: affected, version: 1.2.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
]