VULNERABILITY INTELLIGENCE

CVE-2023-25499

CVSS score5.7 MEDIUM
EPSS probability0.58%
CISA KEVNot currently listed
Published2023-06-22
Last modified2026-09-14
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Description

When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.

Weakness classification

  • security@vaadin.com: CWE-200
  • nvd@nist.gov: CWE-200

Primary references