CVE-2023-25499 - OpenCVE

When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Vaadin	Vaadin

Configuration 1 [-]

OR	cpe:2.3:a:vaadin:vaadin::::::::
	cpe:2.3:a:vaadin:vaadin::::::::
	cpe:2.3:a:vaadin:vaadin::::::::
	cpe:2.3:a:vaadin:vaadin::::::::
	cpe:2.3:a:vaadin:vaadin::::::::
	cpe:2.3:a:vaadin:vaadin:24.1.0:alpha1::::::
	cpe:2.3:a:vaadin:vaadin:24.1.0:alpha2::::::
	cpe:2.3:a:vaadin:vaadin:24.1.0:alpha3::::::
	cpe:2.3:a:vaadin:vaadin:24.1.0:alpha4::::::
	cpe:2.3:a:vaadin:vaadin:24.1.0:alpha5::::::
	cpe:2.3:a:vaadin:vaadin:24.1.0:alpha6::::::
	cpe:2.3:a:vaadin:vaadin:24.1.0:beta1::::::

No data.

References

Link	Providers
https://github.com/vaadin/flow/pull/15885
https://vaadin.com/security/CVE-2023-25499

History

No history.

MITRE

Status: PUBLISHED

Assigner: Vaadin

Published: 2023-06-22T12:47:57.760Z

Updated: 2024-08-02T11:25:18.642Z

Reserved: 2023-02-06T20:44:44.569Z

Link: CVE-2023-25499

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-06-22T13:15:09.660

Modified: 2023-06-30T16:32:37.847

Link: CVE-2023-25499

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-25499", "assignerOrgId": "9e0f3122-90e9-42d5-93de-8c6b98deef7e", "state": "PUBLISHED", "assignerShortName": "Vaadin", "dateReserved": "2023-02-06T20:44:44.569Z", "datePublished": "2023-06-22T12:47:57.760Z", "dateUpdated": "2024-08-02T11:25:18.642Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "vaadin", "repo": "https://github.com/vaadin/platform", "vendor": "vaadin", "versions": [{"lessThanOrEqual": "10.0.22", "status": "affected", "version": "10.0.0", "versionType": "maven"}, {"lessThanOrEqual": "14.10.0", "status": "affected", "version": "11.0.0", "versionType": "maven"}, {"lessThanOrEqual": "22.0.28", "status": "affected", "version": "15.0.0", "versionType": "maven"}, {"lessThanOrEqual": "23.3.12", "status": "affected", "version": "23.0.0", "versionType": "maven"}, {"lessThanOrEqual": "24.0.5", "status": "affected", "version": "24.0.0", "versionType": "maven"}, {"lessThanOrEqual": "24.1.0.beta1", "status": "affected", "version": "24.1.0.alpha1", "versionType": "maven"}]}, {"defaultStatus": "unaffected", "product": "flow-server", "repo": "https://github.com/vaadin/flow", "vendor": "vaadin", "versions": [{"lessThanOrEqual": "24.0.0.beta1", "status": "affected", "version": "1.0.0", "versionType": "maven"}, {"lessThanOrEqual": "2.8.9", "status": "affected", "version": "1.1.0", "versionType": "maven"}, {"lessThanOrEqual": "9.1.0", "status": "affected", "version": "3.3.0", "versionType": "maven"}, {"lessThanOrEqual": "23.3.10", "status": "affected", "version": "23.0.0", "versionType": "maven"}, {"lessThanOrEqual": "24.0.7", "status": "affected", "version": "24.0.0", "versionType": "maven"}, {"lessThanOrEqual": "24.1.0.beta1", "status": "affected", "version": "24.1.0.alpha1", "versionType": "maven"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Kim Lepp\u00e4nen"}], "datePublic": "2023-06-21T22:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.<p></p>"}], "value": "When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9e0f3122-90e9-42d5-93de-8c6b98deef7e", "shortName": "Vaadin", "dateUpdated": "2023-06-22T12:47:57.760Z"}, "references": [{"url": "https://vaadin.com/security/CVE-2023-25499"}, {"url": "https://github.com/vaadin/flow/pull/15885"}], "source": {"discovery": "UNKNOWN"}, "title": "Possible information disclosure in non visible components", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:25:18.642Z"}, "title": "CVE Program Container", "references": [{"url": "https://vaadin.com/security/CVE-2023-25499", "tags": ["x_transferred"]}, {"url": "https://github.com/vaadin/flow/pull/15885", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "matchCriteriaId": "12F1F29D-69E8-406E-BB2F-EA3F141CECD7", "versionEndExcluding": "10.0.23", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "matchCriteriaId": "B100421F-58C7-454A-949C-338C4B990925", "versionEndExcluding": "14.10.1", "versionStartIncluding": "11.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0719ACD-F9D0-4E28-82BC-AEFE4EB19729", "versionEndIncluding": "22.0.28", "versionStartIncluding": "15.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "matchCriteriaId": "74BA613E-932F-45A3-88D2-EA8B42158429", "versionEndExcluding": "23.3.13", "versionStartIncluding": "23.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F7402D6-2F33-4352-9E70-16EA3C45B795", "versionEndExcluding": "24.0.6", "versionStartIncluding": "24.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vaadin:vaadin:24.1.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "5131784E-6951-4BA6-A473-10BE06E3E0F0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vaadin:vaadin:24.1.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "07747F12-9827-4543-B66F-253326EC247F", "vulnerable": true}, {"criteria": "cpe:2.3:a:vaadin:vaadin:24.1.0:alpha3:*:*:*:*:*:*", "matchCriteriaId": "BD57A5F3-CB86-4B35-823B-DCAEB163D4CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:vaadin:vaadin:24.1.0:alpha4:*:*:*:*:*:*", "matchCriteriaId": "EB94F579-CDCE-4FA4-BCAF-7747813FB7A6", "vulnerable": true}, {"criteria": "cpe:2.3:a:vaadin:vaadin:24.1.0:alpha5:*:*:*:*:*:*", "matchCriteriaId": "4464403F-682A-4506-99E7-2CC4E4288C0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:vaadin:vaadin:24.1.0:alpha6:*:*:*:*:*:*", "matchCriteriaId": "ECF91FB7-2806-40C1-B27D-461B6836AC7A", "vulnerable": true}, {"criteria": "cpe:2.3:a:vaadin:vaadin:24.1.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "4ECE8939-9AB8-44AB-8ECC-96844410A973", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.\n\n"}], "id": "CVE-2023-25499", "lastModified": "2023-06-30T16:32:37.847", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "security@vaadin.com", "type": "Secondary"}]}, "published": "2023-06-22T13:15:09.660", "references": [{"source": "security@vaadin.com", "tags": ["Patch"], "url": "https://github.com/vaadin/flow/pull/15885"}, {"source": "security@vaadin.com", "tags": ["Vendor Advisory"], "url": "https://vaadin.com/security/CVE-2023-25499"}], "sourceIdentifier": "security@vaadin.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@vaadin.com", "type": "Secondary"}]}