CVE-2023-25500

vaadin · information disclosure

CVSS 3.1 3.5 LOWCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2023-25500

Published

Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2023-25500

Published

com.vaadin:vaadin

https://repo.maven.apache.org/maven2

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "vaadin",
                    "vendor": "vaadin",
                    "versions": [
                        {
                            "lessThanOrEqual": "10.0.23",
                            "status": "affected",
                            "version": "10.0.0",
                            "versionType": "maven"
                        },
                        {
                            "lessThanOrEqual": "14.10.1",
                            "status": "affected",
                            "version": "11.0.0",
                            "versionType": "maven"
                        },
                        {
                            "lessThanOrEqual": "22.0.28",
                            "status": "affected",
                            "version": "15.0.0",
                            "versionType": "maven"
                        },
                        {
                            "lessThanOrEqual": "23.3.13",
                            "status": "affected",
                            "version": "23.0.0",
                            "versionType": "maven"
                        },
                        {
                            "lessThanOrEqual": "24.0.6",
                            "status": "affected",
                            "version": "24.0.0",
                            "versionType": "maven"
                        },
                        {
                            "lessThanOrEqual": "24.1.0.rc2",
                            "status": "affected",
                            "version": "24.1.0.alpha1",
                            "versionType": "maven"
                        }
                    ],
                    "collectionURL": "https://repo.maven.apache.org/maven2",
                    "packageName": "com.vaadin:vaadin",
                    "repo": "https://github.com/vaadin/platform"
                }

com.vaadin:flow-server

https://repo.maven.apache.org/maven2

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "flow-server",
                    "vendor": "flow",
                    "versions": [
                        {
                            "lessThanOrEqual": "1.0.20",
                            "status": "affected",
                            "version": "1.0.0",
                            "versionType": "maven"
                        },
                        {
                            "lessThanOrEqual": "2.9.2",
                            "status": "affected",
                            "version": "1.1.0",
                            "versionType": "maven"
                        },
                        {
                            "lessThanOrEqual": "9.1.1",
                            "status": "affected",
                            "version": "3.0.0",
                            "versionType": "maven"
                        },
                        {
                            "lessThanOrEqual": "23.3.12",
                            "status": "affected",
                            "version": "23.0.0",
                            "versionType": "maven"
                        },
                        {
                            "lessThanOrEqual": "24.0.8",
                            "status": "affected",
                            "version": "24.0.0",
                            "versionType": "maven"
                        },
                        {
                            "lessThanOrEqual": "24.1.0.rc3",
                            "status": "affected",
                            "version": "24.1.0.alpha1",
                            "versionType": "maven"
                        }
                    ],
                    "collectionURL": "https://repo.maven.apache.org/maven2",
                    "packageName": "com.vaadin:flow-server",
                    "repo": "https://github.com/vaadin/flow"
                }

Original source record · Cite this exact observation · Complete original publisher JSON