CVE-2023-25500: fallo de gravedad baja en vaadin
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 3.5epss 0.5%
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVEs relacionadas — vaadin
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-25499MEDIUMPossible information disclosure in non visible componentsEPSS 0.6%CVE-2026-107588HIGHMultiple Vulnerabilities in the Highcharts Library Bundled with Vaadin ChartsEPSS 0.5%CVE-2026-91860MEDIUMPrototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep MergeEPSS 0.5%CVE-2026-2742MEDIUMUnauthorized session creation via reserved framework path accessEPSS 0.4%CVE-2025-9467MEDIUMPossibility to bypass file upload validation on the server-sideEPSS 0.4%CVE-2026-2741LOWZip Slip Path Traversal on Node UnpackEPSS 0.4%