Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-33605

CVE-2021-33605:
Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20

4.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-33605
GHSA ID
GHSA-qcc4-3rxf-gf4m
EPSS Score
0.45939%
CWE
CWE-754
Published
8/30/2021
Updated
5/1/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
com.vaadin:vaadin-checkbox-flowmaven>= 12.0.0, < 14.6.814.6.8
com.vaadin:vaadin-checkbox-flowmaven>= 15.0.0, < 20.0.620.0.6

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the hasValidValue() method's validation logic. The pre-patch version (vulnerable) used: 'selectedItems.stream().allMatch(itemEnabledProvider)', which only ensured currently selected items are enabled. The patched version introduces comparison between old and new values for disabled items. This indicates the vulnerability existed in the original validation logic that failed to properly check if disabled items' values were being modified - a classic CWE-754 scenario of missing exceptional condition checks for disabled components.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Improp*r ****k in `****k*ox*roup` in `*om.v***in:v***in-****k*ox-*low` v*rsions *.*.* prior to *.*.* (V***in **.*.* prior to **.*.*), *.*.* prior to *.*.* (V***in **.*.* prior to **.*.*), *.*.* t*rou** *.*.* (V***in **.*.* t*rou** **.*.**), **.*.* t*

Reasoning

T** vuln*r**ility st*ms *rom t** `**sV*li*V*lu*()` m*t*o*'s v*li**tion lo*i*. T** pr*-p*t** v*rsion (vuln*r**l*) us**: 's*l**t**It*ms.str**m().*llM*t**(it*m*n**l**Provi**r)', w*i** only *nsur** *urr*ntly s*l**t** it*ms *r* *n**l**. T** p*t**** v*rsio