CVE-2023-25500lowCWE-200

CVE-2023-25500: falha de baixa gravidade em vaadin

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Vaadin+ Monitorar flow-server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.5epss 0.5%
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Produtos afetados
flow · flow-servervaadin · vaadin
CVEs relacionadas — vaadin

No mesmo produto, das mais perigosas para as menos.

CVE-2023-25499MEDIUMPossible information disclosure in non visible componentsEPSS 0.6%CVE-2026-107588HIGHMultiple Vulnerabilities in the Highcharts Library Bundled with Vaadin ChartsEPSS 0.5%CVE-2026-91860MEDIUMPrototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep MergeEPSS 0.5%CVE-2026-2742MEDIUMUnauthorized session creation via reserved framework path accessEPSS 0.4%CVE-2025-9467MEDIUMPossibility to bypass file upload validation on the server-sideEPSS 0.4%CVE-2026-2741LOWZip Slip Path Traversal on Node UnpackEPSS 0.4%