Skip to content
CVE PROGRAM SOURCE RECORD3.5 Low

CVE-2023-25500

Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in po

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Vaadin

Description

Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

vaadin vaadin

Default version status: unaffected

  • 10.0.0 to ≤ 10.0.23affected
  • 11.0.0 to ≤ 14.10.1affected
  • 15.0.0 to ≤ 22.0.28affected
  • 23.0.0 to ≤ 23.3.13affected
  • 24.0.0 to ≤ 24.0.6affected
  • 24.1.0.alpha1 to ≤ 24.1.0.rc2affected

flow flow-server

Default version status: unaffected

  • 1.0.0 to ≤ 1.0.20affected
  • 1.1.0 to ≤ 2.9.2affected
  • 3.0.0 to ≤ 9.1.1affected
  • 23.0.0 to ≤ 23.3.12affected
  • 24.0.0 to ≤ 24.0.8affected
  • 24.1.0.alpha1 to ≤ 24.1.0.rc3affected

References