CVE-2023-25499: fallo de gravedad media en vaadin
Possible information disclosure in non visible components
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.7epss 0.6%
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVEs relacionadas — vaadin
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-107588HIGHMultiple Vulnerabilities in the Highcharts Library Bundled with Vaadin ChartsEPSS 0.5%CVE-2023-25500LOWCVE-2023-25500EPSS 0.5%CVE-2026-91860MEDIUMPrototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep MergeEPSS 0.5%CVE-2026-2742MEDIUMUnauthorized session creation via reserved framework path accessEPSS 0.4%CVE-2025-9467MEDIUMPossibility to bypass file upload validation on the server-sideEPSS 0.4%CVE-2026-2741LOWZip Slip Path Traversal on Node UnpackEPSS 0.4%