CVE-2022-29567: Possible information disclosure inside TreeGrid component with default data provider
Description
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-29567?
CVE-2022-29567 has been classified as a medium severity vulnerability.
How do I fix CVE-2022-29567?
To fix CVE-2022-29567, you should upgrade to Vaadin versions 23.0.9, 22.0.15, or 14.8.10 depending on your current version.
What software is affected by CVE-2022-29567?
CVE-2022-29567 affects Vaadin versions 14.8.5 to 14.8.9, 22.0.6 to 22.0.14, and several beta and alpha versions of 23.0.0.
What causes CVE-2022-29567?
CVE-2022-29567 is caused by the default configuration of the TreeGrid component using Object::toString as a key in client-server communication.
Is there a workaround for CVE-2022-29567?
There is no official workaround for CVE-2022-29567 other than applying the recommended software updates.