CVE-2022-29567: Possible information disclosure inside TreeGrid component with default data provider
Description
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.vaadin:vaadin-grid-flowto a version that resolves this vulnerability.Fixed in 23.0.9 - Upgrade
Upgrade
maven/com.vaadin:vaadin-grid-flowto a version that resolves this vulnerability.Fixed in 22.0.15 - Upgrade
Upgrade
maven/com.vaadin:vaadin-grid-flowto a version that resolves this vulnerability.Fixed in 14.8.10 - Upgrade
Upgrade
maven/com.vaadin:vaadinto a version that resolves this vulnerability.Fixed in 23.0.9 - Upgrade
Upgrade
maven/com.vaadin:vaadinto a version that resolves this vulnerability.Fixed in 22.0.15 - Upgrade
Upgrade
maven/com.vaadin:vaadinto a version that resolves this vulnerability.Fixed in 14.8.10 - Compensating control
Mitigate by changing the TreeGrid component’s default data provider configuration so it does not use Object::toString as a client-side key (to prevent potential information disclosure of values that should not be available on the client-side). Applies to Vaadin versions: 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8, and 23.1.0.alpha1 through 23.1.0.alpha4.
Event History
Frequently Asked Questions
What is the severity of CVE-2022-29567?
CVE-2022-29567 has been classified as a medium severity vulnerability.
How do I fix CVE-2022-29567?
To fix CVE-2022-29567, you should upgrade to Vaadin versions 23.0.9, 22.0.15, or 14.8.10 depending on your current version.
What software is affected by CVE-2022-29567?
CVE-2022-29567 affects Vaadin versions 14.8.5 to 14.8.9, 22.0.6 to 22.0.14, and several beta and alpha versions of 23.0.0.
What causes CVE-2022-29567?
CVE-2022-29567 is caused by the default configuration of the TreeGrid component using Object::toString as a key in client-server communication.
Is there a workaround for CVE-2022-29567?
There is no official workaround for CVE-2022-29567 other than applying the recommended software updates.