6.5

CVE-2023-25499

When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Vaadin ≫ Vaadin Version >= 10.0.0 < 10.0.23
Vaadin ≫ Vaadin Version >= 11.0.0 < 14.10.1
Vaadin ≫ Vaadin Version >= 15.0.0 <= 22.0.28
Vaadin ≫ Vaadin Version >= 23.0.0 < 23.3.13
Vaadin ≫ Vaadin Version >= 24.0.0 < 24.0.6
Vaadin ≫ Vaadin Version24.1.0 Updatealpha1
Vaadin ≫ Vaadin Version24.1.0 Updatealpha2
Vaadin ≫ Vaadin Version24.1.0 Updatealpha3
Vaadin ≫ Vaadin Version24.1.0 Updatealpha4
Vaadin ≫ Vaadin Version24.1.0 Updatealpha5
Vaadin ≫ Vaadin Version24.1.0 Updatealpha6
Vaadin ≫ Vaadin Version24.1.0 Updatebeta1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.463
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
security@vaadin.com 5.7 2.1 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.