low3.5
CVE-2023-25500
Vaadin vulnerable to possible information disclosure of class and method names in RPC response
Impact
### Description Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests. https://vaadin.com/security/cve-2023-25500
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.vaadin:flow-server | >= 1.0.0, < 1.0.21 | 1.0.21 |
| maven | com.vaadin:vaadin | >= 10.0.0, < 10.0.24 | 10.0.24 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vaadin | Vaadin | from 10.0.0 before 10.0.23 from 11.0.0 before 14.10.2 from 15.0.0 through 22.0.28 from 23.0.0 before 23.3.14 from 24.0.0 before 24.0.7 Version 24.1.0 |