A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist yet also creates the row and the cell.<\/p>\n
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:<\/p>\n
Product version
\nVaadin 23.1.0 – 23.6.13
\nVaadin 24.0.0 – 24.9.21
\nVaadin 24.10.0 – 24.10.9
\nVaadin 25.0.0 – 25.1.11
\nVaadin 25.2.0 – 25.2.6
\nVaadin Framework 7 and 8 with the Spreadsheet add-on 2.0.0 – 3.1.0<\/p>\n
Mitigation
\nUpgrade to 23.6.14
\nUpgrade to 24.9.22
\nUpgrade to 24.10.10
\nUpgrade to 25.1.12
\nUpgrade to 25.2.7 or newer
\nUpgrade the Spreadsheet add-on to 3.1.1<\/p>\n
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.<\/p>\n
Artifacts
\nMaven coordinates Vulnerable versions Fixed version
\ncom.vaadin:vaadin 23.1.0 – 23.6.13 >=23.6.14
\ncom.vaadin:vaadin 24.0.0 – 24.9.21 >=24.9.22
\ncom.vaadin:vaadin 24.10.0 – 24.10.9 >=24.10.10
\ncom.vaadin:vaadin 25.0.0 – 25.1.11 >=25.1.12
\ncom.vaadin:vaadin 25.2.0 – 25.2.6 >=25.2.7
\ncom.vaadin:vaadin-spreadsheet-flow 23.1.0 – 23.6.13 >=23.6.14
\ncom.vaadin:vaadin-spreadsheet-flow 24.0.0 – 24.9.21 >=24.9.22
\ncom.vaadin:vaadin-spreadsheet-flow 24.10.0 – 24.10.9 >=24.10.10
\ncom.vaadin:vaadin-spreadsheet-flow 25.0.0 – 25.1.11 >=25.1.12
\ncom.vaadin:vaadin-spreadsheet-flow 25.2.0 – 25.2.6 >=25.2.7
\ncom.vaadin:vaadin-spreadsheet 2.0.0 – 3.1.0 >=3.1.1<\/p>\n","protected":false},"excerpt":{"rendered":"
A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protecti<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-31296","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/31296","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=31296"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=31296"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=31296"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}