Test ID:	1.3.6.1.4.1.25623.1.0.105179
Category:	Web application abuses
Title:	Vaadin Framework < 6.6.7 / 6.7.0 Multiple Vulnerabilities
Summary:	This web application is running with the Vaadin Framework which; is prone to multiple cross-site scripting, information disclosure, and security bypass issues; because the application fails to properly sanitize user-supplied input.
Description:	Summary: This web application is running with the Vaadin Framework which is prone to multiple cross-site scripting, information disclosure, and security bypass issues because the application fails to properly sanitize user-supplied input. Vulnerability Insight: Multiple flaws exist due to: - A directory traversal vulnerability through AbstractApplicationServlet.serveStaticResourcesInVAADIN() - CSRF/XSS vulnerability through separator injection - Contributory XSS: Possibility to inject HTML/javascript in system error messages - Contributory XSS: possibility for injection in certain components Vulnerability Impact: Successful exploitation could allow: - A remote attacker to leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. - Exploiting the information disclosure issues allows the attacker to view local files within the context of the Web server process. - Exploiting the security bypass vulnerability allows attackers to bypass security restrictions and obtain sensitive information or perform unauthorized actions. Affected Software/OS: Vaadin Framework versions from 6.0.0 up to 6.6.6 Solution: Upgrade to Vaadin Framework version 6.6.7 or later / 6.7.0 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Copyright	Copyright (C) 2015 SCHUTZWERK GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.