CVE-2021-33611

    Dashboard / Vulnerabilities / CVE-2021-33611

    CVE-2021-33611

    Published: 2 Nov 2021Last Modified: 8 Jul 2026

    Summary:

    Details: Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL

    References: https://github.com/vaadin/vaadin-menu-bar/pull/126, https://vaadin.com/security/cve-2021-33611

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ca9cf99092245a31a84b317adf1d79a397970d27
    Fixed -3411feab4bba930a1b2f0e2067d749708e652359

    Affected versions

    v14.4.0
    v14.4.3
    v14.4.2
    v14.4.1
    v14.4.0-rc1
    v14.4.0-beta2
    v14.4.0-beta1
    v14.4.0-alpha1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-33611 | CVE-DB