6.5

CVE-2023-25499

Possible information disclosure in non visible components

When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Vaadin ≫ Vaadin Version >= 10.0.0 < 10.0.23
Vaadin ≫ Vaadin Version >= 11.0.0 < 14.10.1
Vaadin ≫ Vaadin Version >= 15.0.0 <= 22.0.28
Vaadin ≫ Vaadin Version >= 23.0.0 < 23.3.13
Vaadin ≫ Vaadin Version >= 24.0.0 < 24.0.6
Vaadin ≫ Vaadin Version24.1.0 Updatealpha1
Vaadin ≫ Vaadin Version24.1.0 Updatealpha2
Vaadin ≫ Vaadin Version24.1.0 Updatealpha3
Vaadin ≫ Vaadin Version24.1.0 Updatealpha4
Vaadin ≫ Vaadin Version24.1.0 Updatealpha5
Vaadin ≫ Vaadin Version24.1.0 Updatealpha6
Vaadin ≫ Vaadin Version24.1.0 Updatebeta1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.58% 0.431
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
security@vaadin.com 5.7 2.1 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://github.com/vaadin/flow/pull/15885
Patch
https://vaadin.com/security/CVE-2023-25499
Vendor Advisory