CVE-2023-25499 Possible information disclosure in non visible components

2023-06-2212:47:57

CWE-200

Vaadin

www.cve.org

cve-2023-25499

vaadin 10.0.0

vaadin 24.1.0.beta1

information disclosure

5.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

35.2%

JSON

When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "vaadin",
    "repo": "https://github.com/vaadin/platform",
    "vendor": "vaadin",
    "versions": [
      {
        "lessThanOrEqual": "10.0.22",
        "status": "affected",
        "version": "10.0.0",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "14.10.0",
        "status": "affected",
        "version": "11.0.0",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "22.0.28",
        "status": "affected",
        "version": "15.0.0",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "23.3.12",
        "status": "affected",
        "version": "23.0.0",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "24.0.5",
        "status": "affected",
        "version": "24.0.0",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "24.1.0.beta1",
        "status": "affected",
        "version": "24.1.0.alpha1",
        "versionType": "maven"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "flow-server",
    "repo": "https://github.com/vaadin/flow",
    "vendor": "vaadin",
    "versions": [
      {
        "lessThanOrEqual": "24.0.0.beta1",
        "status": "affected",
        "version": "1.0.0",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "2.8.9",
        "status": "affected",
        "version": "1.1.0",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "9.1.0",
        "status": "affected",
        "version": "3.3.0",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "23.3.10",
        "status": "affected",
        "version": "23.0.0",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "24.0.7",
        "status": "affected",
        "version": "24.0.0",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "24.1.0.beta1",
        "status": "affected",
        "version": "24.1.0.alpha1",
        "versionType": "maven"
      }
    ]
  }
]