Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-25500: Vaadin: Malicious requests expose internal class and method names

CVE-2023-25500 · published 3 years ago

Summary

Certain versions of Vaadin may allow an attacker to obtain sensitive information about the application's internal structure by crafting specific requests. This could potentially be used to gather intelligence about the application's architecture or identify potential vulnerabilities. Affected users should update to the latest version of Vaadin to address this issue.

What to do

Update vaadin com.vaadin:flow-server to version 1.0.21.
Update vaadin com.vaadin:flow-server to version 2.9.3.
Update vaadin com.vaadin:flow-server to version 9.1.2.
Update vaadin com.vaadin:flow-server to version 23.3.13.
Update vaadin com.vaadin:flow-server to version 24.0.9.
Update vaadin com.vaadin:flow-server to version 24.1.0.
Update vaadin com.vaadin:vaadin to version 10.0.24.
Update vaadin com.vaadin:vaadin to version 14.10.2.
Update vaadin com.vaadin:vaadin to version 22.1.0.
Update vaadin com.vaadin:vaadin to version 23.3.14.
Update vaadin com.vaadin:vaadin to version 24.0.7.
Update vaadin com.vaadin:vaadin to version 24.1.0.

Affected software

Ecosystem	Vendor	Product	Affected versions
maven	vaadin	com.vaadin:flow-server	>= 1.0.0, < 1.0.21 >= 1.1.0, < 2.9.3 >= 3.0.0, < 9.1.2 >= 23.0.0, < 23.3.13 >= 24.0.0, < 24.0.9 >= 24.1.alpha1, < 24.1.0 Fix: upgrade to 1.0.21
maven	vaadin	com.vaadin:vaadin	>= 10.0.0, < 10.0.24 >= 11.0.0, < 14.10.2 >= 15.0.0, < 22.1.0 >= 23.0.0, < 23.3.14 >= 24.0.0, < 24.0.7 >= 24.1.0.alpha1, < 24.1.0 Fix: upgrade to 10.0.24
–	vaadin	vaadin	>= 10.0.0, < 10.0.23 >= 11.0.0, < 14.10.2 >= 15.0.0, <= 22.0.28 >= 23.0.0, < 23.3.14 >= 24.0.0, < 24.0.7 24.1.0 `cpe:2.3:a:vaadin:vaadin::::::::`

Original advisory text

Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential informati...

References

https://github.com/vaadin/platform/security/advisories/GHSA-ch48-9r3q-pv7x
https://github.com/advisories/GHSA-ch48-9r3q-pv7x
https://repo.maven.apache.org/maven2 URL
https://vaadin.com/security/cve-2023-25500 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25500... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-25500 Vendor Advisory
https://github.com/vaadin/flow/pull/16935 Patch
https://github.com/vaadin/flow Product
https://github.com/vaadin/platform Product

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.5 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-200Information Exposure

CWE-1295Debug Messages Revealing Unnecessary Information

Timeline

Published22 Jun 2023

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-ch48-9r3q-pv7x · GHSA

CVE-2023-25500 · NVD

CVE-2023-25500 · OSV

Track software like this

Free during beta