CVE-2023-25499CWE-200information-disclosure

CVE-2023-25499

Medium · published June 22, 2023

CVSS v3.1
5.7
EPSS
1%
Percentile
47.0
In the wild
Unconfirmed
What it is

When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00580 · 47.0th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-06-22T17:15Z
Affected products (12)
ProductVersionsFixed in
vaadin/vaadin≥ 10.0.0, < 10.0.2310.0.23
vaadin/vaadin≥ 11.0.0, < 14.10.114.10.1
vaadin/vaadin≥ 15.0.0, ≤ 22.0.28—
vaadin/vaadin≥ 23.0.0, < 23.3.1323.3.13
vaadin/vaadin≥ 24.0.0, < 24.0.624.0.6
vaadin/vaadinall versions—
vaadin/vaadinall versions—
vaadin/vaadinall versions—
vaadin/vaadinall versions—
vaadin/vaadinall versions—
vaadin/vaadinall versions—
vaadin/vaadinall versions—
References (4)
https://github.com/vaadin/flow/pull/15885 · [email protected]https://vaadin.com/security/CVE-2023-25499 · [email protected]https://github.com/vaadin/flow/pull/15885 · af854a3a-2127-422b-91ae-364da2661108https://vaadin.com/security/CVE-2023-25499 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 22 JUN 12:47Z
    Possible information disclosure in non visible components
    cvelistv5