When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.
References
| Link | Resource |
|---|---|
| https://github.com/vaadin/flow/pull/15885 | Patch |
| https://vaadin.com/security/CVE-2023-25499 | Vendor Advisory |
| https://github.com/vaadin/flow/pull/15885 | Patch |
| https://vaadin.com/security/CVE-2023-25499 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/vaadin/flow/pull/15885 - Patch | |
| References | () https://vaadin.com/security/CVE-2023-25499 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.7 |
30 Jun 2023, 16:32
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/vaadin/flow/pull/15885 - Patch | |
| References | (MISC) https://vaadin.com/security/CVE-2023-25499 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CWE | CWE-200 | |
| CPE | cpe:2.3:a:vaadin:vaadin:24.1.0:alpha2:*:*:*:*:*:* cpe:2.3:a:vaadin:vaadin:24.1.0:alpha1:*:*:*:*:*:* cpe:2.3:a:vaadin:vaadin:24.1.0:alpha6:*:*:*:*:*:* cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* cpe:2.3:a:vaadin:vaadin:24.1.0:alpha3:*:*:*:*:*:* cpe:2.3:a:vaadin:vaadin:24.1.0:beta1:*:*:*:*:*:* cpe:2.3:a:vaadin:vaadin:24.1.0:alpha4:*:*:*:*:*:* cpe:2.3:a:vaadin:vaadin:24.1.0:alpha5:*:*:*:*:*:* |
|
| First Time |
Vaadin
Vaadin vaadin |
22 Jun 2023, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-22 13:15
Updated : 2024-11-21 07:49
NVD link : CVE-2023-25499
Mitre link : CVE-2023-25499
CVE.ORG link : CVE-2023-25499
JSON object : View
Products Affected
vaadin
- vaadin
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor