CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2023-25500
Medium (4.3) in vaadin vaadin. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in com.vaadin:flow-server 1.0.21, 2.9.3, 23.3.13.
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vaadin:vaadin
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-ch48-9r3q-pv7x | Maven | com.vaadin:flow-server | >=1.0.0 <1.0.21 | 1.0.21 |
| GHSA-ch48-9r3q-pv7x | Maven | com.vaadin:flow-server | >=1.1.0 <2.9.3 | 2.9.3 |
| GHSA-ch48-9r3q-pv7x | Maven | com.vaadin:flow-server | >=3.0.0 <9.1.2 | 9.1.2 |
| GHSA-ch48-9r3q-pv7x | Maven | com.vaadin:flow-server | >=23.0.0 <23.3.13 | 23.3.13 |
| GHSA-ch48-9r3q-pv7x | Maven | com.vaadin:flow-server | >=24.0.0 <24.0.9 | 24.0.9 |
| GHSA-ch48-9r3q-pv7x | Maven | com.vaadin:flow-server | >=24.1.alpha1 <24.1.0 | 24.1.0 |
| GHSA-ch48-9r3q-pv7x | Maven | com.vaadin:vaadin | >=10.0.0 <10.0.24 | 10.0.24 |
| GHSA-ch48-9r3q-pv7x | Maven | com.vaadin:vaadin | >=11.0.0 <14.10.2 | 14.10.2 |
| GHSA-ch48-9r3q-pv7x | Maven | com.vaadin:vaadin | >=15.0.0 <22.1.0 | 22.1.0 |
| GHSA-ch48-9r3q-pv7x | Maven | com.vaadin:vaadin | >=23.0.0 <23.3.14 | 23.3.14 |
| GHSA-ch48-9r3q-pv7x | Maven | com.vaadin:vaadin | >=24.0.0 <24.0.7 | 24.0.7 |
| GHSA-ch48-9r3q-pv7x | Maven | com.vaadin:vaadin | >=24.1.0.alpha1 <24.1.0 | 24.1.0 |