GHSA-ch48-9r3q-pv7xLowCVSS 3.5

Vaadin vulnerable to possible information disclosure of class and method names in RPC response

Published
June 22, 2023
Last Modified
November 11, 2023

🔗 CVE IDs covered (1)

CVE-2023-25500 →

📋 Description

Description

Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.

https://vaadin.com/security/cve-2023-25500

🎯 Affected products12

  • maven/com.vaadin:flow-server:>= 1.0.0, < 1.0.21
  • maven/com.vaadin:flow-server:>= 1.1.0, < 2.9.3
  • maven/com.vaadin:flow-server:>= 3.0.0, < 9.1.2
  • maven/com.vaadin:flow-server:>= 23.0.0, < 23.3.13
  • maven/com.vaadin:flow-server:>= 24.0.0, < 24.0.9
  • maven/com.vaadin:flow-server:>= 24.1.alpha1, < 24.1.0
  • maven/com.vaadin:vaadin:>= 10.0.0, < 10.0.24
  • maven/com.vaadin:vaadin:>= 11.0.0, < 14.10.2
  • maven/com.vaadin:vaadin:>= 15.0.0, < 22.1.0
  • maven/com.vaadin:vaadin:>= 23.0.0, < 23.3.14
  • maven/com.vaadin:vaadin:>= 24.0.0, < 24.0.7
  • maven/com.vaadin:vaadin:>= 24.1.0.alpha1, < 24.1.0

🔗 References (5)