CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2022-29567
High (7.5) in vaadin vaadin. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in com.vaadin:vaadin 14.8.10, 22.0.15, 23.0.9.
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vaadin:vaadin
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qfr3-323w-qv27 | Maven | com.vaadin:vaadin | >=14.8.5 <14.8.10 | 14.8.10 |
| GHSA-qfr3-323w-qv27 | Maven | com.vaadin:vaadin | >=22.0.6 <22.0.15 | 22.0.15 |
| GHSA-qfr3-323w-qv27 | Maven | com.vaadin:vaadin | >=23.0.0 <23.0.9 | 23.0.9 |
| GHSA-qfr3-323w-qv27 | Maven | com.vaadin:vaadin-grid-flow | >=14.8.5 <14.8.10 | 14.8.10 |
| GHSA-qfr3-323w-qv27 | Maven | com.vaadin:vaadin-grid-flow | >=22.0.6 <22.0.15 | 22.0.15 |
| GHSA-qfr3-323w-qv27 | Maven | com.vaadin:vaadin-grid-flow | >=23.0.0.beta2 <23.0.9 | 23.0.9 |