CVE-2023-25500: Infoleak

Q: What is the severity of CVE-2023-25500?

CVE-2023-25500 has been classified as a moderate severity vulnerability due to its potential for information disclosure.

Q: How do I fix CVE-2023-25500?

To mitigate CVE-2023-25500, update to a non-vulnerable version of Vaadin, such as 24.1.0, 24.0.7, 23.3.14, 22.1.0, or 14.10.2.

Q: What versions of Vaadin are affected by CVE-2023-25500?

CVE-2023-25500 affects Vaadin versions from 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, and 15.0.0 to the latest versions up to 24.0.6.

Q: What type of issue does CVE-2023-25500 introduce?

CVE-2023-25500 introduces a risk of information disclosure where class and method names can be revealed through RPC responses.

Q: Is CVE-2023-25500 specific to Vaadin framework versions only?

Yes, CVE-2023-25500 specifically pertains to various versions of the Vaadin framework and its flow server packages.

Published Jun 22, 2023

Updated

Description Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.

https://vaadin.com/security/cve-2023-25500

Affected Software

28 affected componentsFixes available

maven/com.vaadin:vaadin>=24.1.0.alpha1<24.1.0

24.1.0

maven/com.vaadin:vaadin>=24.0.0<24.0.7

24.0.7

maven/com.vaadin:vaadin>=23.0.0<23.3.14

23.3.14

maven/com.vaadin:vaadin>=15.0.0<22.1.0

22.1.0

maven/com.vaadin:vaadin>=11.0.0<14.10.2

14.10.2

maven/com.vaadin:vaadin>=10.0.0<10.0.24

10.0.24

maven/com.vaadin:flow-server>=24.1.alpha1<24.1.0

24.1.0

maven/com.vaadin:flow-server>=24.0.0<24.0.9

24.0.9

maven/com.vaadin:flow-server>=23.0.0<23.3.13

23.3.13

maven/com.vaadin:flow-server>=3.0.0<9.1.2

9.1.2

maven/com.vaadin:flow-server>=1.1.0<2.9.3

2.9.3

maven/com.vaadin:flow-server>=1.0.0<1.0.21

1.0.21

Vaadin Vaadin>=10.0.0<10.0.23

Vaadin Vaadin>=11.0.0<14.10.2

Vaadin Vaadin>=15.0.0<=22.0.28

Vaadin Vaadin>=23.0.0<23.3.14

Vaadin Vaadin>=24.0.0<24.0.7

Vaadin Vaadin=24.1.0-alpha1

Vaadin Vaadin=24.1.0-alpha2

Vaadin Vaadin=24.1.0-alpha3

Vaadin Vaadin=24.1.0-alpha4

Vaadin Vaadin=24.1.0-alpha5

Vaadin Vaadin=24.1.0-alpha6

Vaadin Vaadin=24.1.0-beta1

Vaadin Vaadin=24.1.0-beta2

Vaadin Vaadin=24.1.0-beta3

Vaadin Vaadin=24.1.0-rc1

Vaadin Vaadin=24.1.0-rc2

Remediation

Patch Available

https://github.com/vaadin/flow/pull/16935

Event History

Jun 22, 2023

CVE Published

via MITRE·12:49 PM

Data Sourced

via MITRE·12:49 PM

DescriptionSeverityWeakness

Advisory Published

08:01 PM

Frequently Asked Questions

What is the severity of CVE-2023-25500?

CVE-2023-25500 has been classified as a moderate severity vulnerability due to its potential for information disclosure.

How do I fix CVE-2023-25500?

To mitigate CVE-2023-25500, update to a non-vulnerable version of Vaadin, such as 24.1.0, 24.0.7, 23.3.14, 22.1.0, or 14.10.2.

What versions of Vaadin are affected by CVE-2023-25500?