CVEvulnerability

CVE-2023-25499

6.5 MEDIUM Published 2023-06-22 Modified 2026-09-14 Official page ↗
Status
Modified
Published
2023-06-22
Last modified
2026-09-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.7 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200

Description

When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.

Affected configurations

• vaadin vaadin (>= 10.0.0 < 10.0.23) • vaadin vaadin (>= 11.0.0 < 14.10.1) • vaadin vaadin (>= 15.0.0 <= 22.0.28) • vaadin vaadin (>= 23.0.0 < 23.3.13) • vaadin vaadin (>= 24.0.0 < 24.0.6) • vaadin vaadin 24.1.0

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References