CVE-2023-25499mediumCWE-200

CVE-2023-25499: falha de média gravidade em vaadin

Possible information disclosure in non visible components

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Vaadin+ Monitorar flow-server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.7epss 0.6%
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Produtos afetados
vaadin · flow-servervaadin · vaadin
CVEs relacionadas — vaadin

No mesmo produto, das mais perigosas para as menos.

CVE-2026-107588HIGHMultiple Vulnerabilities in the Highcharts Library Bundled with Vaadin ChartsEPSS 0.5%CVE-2023-25500LOWCVE-2023-25500EPSS 0.5%CVE-2026-91860MEDIUMPrototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep MergeEPSS 0.5%CVE-2026-2742MEDIUMUnauthorized session creation via reserved framework path accessEPSS 0.4%CVE-2025-9467MEDIUMPossibility to bypass file upload validation on the server-sideEPSS 0.4%CVE-2026-2741LOWZip Slip Path Traversal on Node UnpackEPSS 0.4%