CVE-2023-25499
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
In Vaadin, adding non-visible components to the UI on the server side causes their content to be sent to the browser, potentially leading to information disclosure. Affected versions include 10.0.0-10.0.22, 11.0.0-14.10.0, 15.0.0-22.0.28, 23.0.0-23.3.12, 24.0.0-24.0.5, and 24.1.0.alpha1-24.1.0.beta1.
Risk Assessment
An attacker may gain access to data that should remain hidden from the client, potentially breaching information confidentiality. The risk affects Vaadin applications where non-visible components containing sensitive data are created on the server side.
Recommendation
Upgrade Vaadin to a version containing the fix. Review the application for non-visible components containing sensitive data and ensure they are not sent to the client.
Other vulnerabilities in Vaadin
See all- CVE-2025-9467Medium
In the Vaadin Upload component, when the start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Affected versions include Vaadin 7.0.0-7.7.47, 8.0.0-8.28.1, 14.0.0-14.13.0, 23.0.0-23.6.1, and 24.0.0-24.7.6.
- CVE-2023-25500Low
In Vaadin, in many versions, a vulnerability allows information disclosure of class and method names in RPC responses by sending modified requests.
- CVE-2022-29567Medium
The default configuration of the TreeGrid component uses Object::toString as a key in client-side and server communication in Vaadin, potentially disclosing values that should not be available on the client side. Affected versions include Vaadin 14.8.5-14.8.9, 22.0.6-22.0.14, 23.0.0.beta2-23.0.8, and 23.1.0.alpha1-23.1.0.alpha4.
Original NVD description (English source)
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.