CVE-2021-33605
Last modified
CVE-2021-33605 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled Checkbox inside enabled CheckboxGroup component via unspecified vectors.. EPSS estimates a 0.59% chance of exploitation in the next 30 days.
Description
Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled Checkbox inside enabled CheckboxGroup component via unspecified vectors.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vaadin | Vaadin-Checkbox-Flow | >= 1.2.0, < 2.0.0 |
| Vaadin | Vaadin-Checkbox-Flow | >= 2.0.0, < 3.0.0 |
| Vaadin | Vaadin-Checkbox-Flow | >= 3.0.0, < 4.0.1 |
| Vaadin | Vaadin-Checkbox-Flow | >= 14.5.0, < 14.6.7 |
| Vaadin | Vaadin-Checkbox-Flow | >= 18.0.0, < 20.0.5 |
References
- https://github.com/vaadin/flow-components/pull/1903Patch, Third Party Advisory
- https://vaadin.com/security/cve-2021-33605Vendor Advisory
- https://github.com/vaadin/flow-components/pull/1903Patch, Third Party Advisory
- https://vaadin.com/security/cve-2021-33605Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-33605?
How severe is CVE-2021-33605?
How do I fix CVE-2021-33605?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-33599A vulnerability affecting F-Secure Antivirus engine was disc…5.5
- CVE-2021-33600A denial-of-service (DoS) vulnerability was discovered in th…7.5
- CVE-2021-33601A vulnerability was discovered in the web user interface of …8.8
- CVE-2021-33602A vulnerability affecting the F-Secure Antivirus engine was …5.3
- CVE-2021-33603A Denial-of-Service (DoS) vulnerability was discovered in F-…6.5
- CVE-2021-33604URL encoding error in development mode handler in com.vaadin…2.5
- CVE-2021-33609Missing check in DataCommunicator class in com.vaadin:vaadin…4.3
- CVE-2021-33611Missing output sanitization in test sources in org.webjars.b…6.1
- CVE-2021-33615RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a…7.5
- CVE-2021-33616RSA Archer 6.x through 6.9 SP1 P4 (6.9.1.4) allows stored XS…5.4
- CVE-2021-33617Zoho ManageEngine Password Manager Pro before 11.2 11200 all…5.3
- CVE-2021-33618Dolibarr ERP and CRM 13.0.2 allows XSS via object details, a…6.1
Are you affected by CVE-2021-33605?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST