CVE-2021-33605

Published: Aug 25, 2021Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled Checkbox inside enabled CheckboxGroup component via unspecified vectors.

Affected (5)

Products: Vaadin: Vaadin Checkbox Flow

Vaadin

1 product

Vaadin Checkbox Flow

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Vaadin Vaadin Checkbox Flow	1.2.0 ≤ version < 2.0.0

Running on/with	Platform Versions
Vaadin Vaadin	12.0.0 ≤ version < 14.0.0

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Vaadin Vaadin Checkbox Flow	2.0.0 ≤ version < 3.0.0

Running on/with	Platform Versions
Vaadin Vaadin	14.0.0 ≤ version < 14.5.0

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Vaadin Vaadin Checkbox Flow	3.0.0 ≤ version < 4.0.1

Running on/with	Platform Versions
Vaadin Vaadin	15.0.0 ≤ version < 17.0.11

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Vaadin Vaadin Checkbox Flow	14.5.0 ≤ version < 14.6.7

Running on/with	Platform Versions
Vaadin Vaadin	14.5.0 ≤ version < 14.6.7

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Vaadin Vaadin Checkbox Flow	18.0.0 ≤ version < 20.0.5

Running on/with	Platform Versions
Vaadin Vaadin	18.0.0 ≤ version < 20.0.5

Related CWEs

CWE-754

Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

References (4)

https://github.com/vaadin/flow-components/pull/1903

Source: security@vaadin.com

PatchThird Party Advisory

https://vaadin.com/security/cve-2021-33605

Source: security@vaadin.com

Vendor Advisory

https://github.com/vaadin/flow-components/pull/1903

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://vaadin.com/security/cve-2021-33605

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.