{"action":"Upgrade com.vaadin:flow-server to 1.0.6 or later.","affected":[{"fixed":"1.0.6","introduced":"1.0.0"}],"component":"com.vaadin:flow-server","cve_ids":["CVE-2018-25007"],"ecosystem":"Maven","epss":0.00574,"exploited":false,"fixed_versions":["1.0.6"],"ghsa_id":"GHSA-jmx8-355m-8vwh","id":"tcs_01M5N939PV38CGDWD7D8SP4SZ1","modified_at":"2023-11-08T04:00:14.726765Z","published_at":"2021-04-19T14:53:09Z","references":["https://osv.dev/vulnerability/GHSA-jmx8-355m-8vwh","https://github.com/vaadin/flow/security/advisories/GHSA-jmx8-355m-8vwh","https://nvd.nist.gov/vuln/detail/CVE-2018-25007","https://github.com/vaadin/flow/pull/4774","https://vaadin.com/security/cve-2018-25007"],"severity":{"label":"low","score":2.6},"sources":[{"source":"osv","source_id":"GHSA-jmx8-355m-8vwh","url":"https://osv.dev/vulnerability/GHSA-jmx8-355m-8vwh"}],"summary":"Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11"}