com.vaadin:vaadin-platform-javadoc (>=14.8.5, <=14.8.9), io.devbench.uibuilder.components.util:common (>=2.1.3-dev-220411, <=2.1.3-dev-220924) +63 more potentially affected by CVE-2022-29567 via com.vaadin:vaadin (>=14.8.5, <=14.8.9)

com.vaadin:vaadin MAVEN version =14.8.5, =14.8.5, =2.1.3-dev-220411, =2.1.3-dev-220411, =2.1.3-dev-220411, =2.1.3-dev-220411, =2.1.3-dev-220411, =2.1.3-dev-220411, =2.1.3-dev-220411, =2.1.3-dev-220411, =2.1.3-dev-220411, =2.1.3-dev-220411, =2.1.3-dev-220411, =2.1.3-dev-220411, =2.1.3-dev-220924 -...

com.vaadin:vaadin-jandex (>=23.0.0, <=23.0.8), com.vaadin:vaadin-platform-javadoc (>=23.0.0, <=23.0.8) +3 more potentially affected by CVE-2022-29567 via com.vaadin:vaadin (>=23.0.0, <=23.0.8)

com.vaadin:vaadin MAVEN version =23.0.0, =23.0.0, =23.0.0, =23.0.8 - de.jfancy:star-rating 1.0.3 - io.rocketbase.commons:commons-vaadin-core 0.1.0 - io.rocketbase.commons:sample 0.1.0 Source cves: CVE-2022-29567 Source advisory: OSV:GHSA-QFR3-323W-QV27...

com.vaadin:vaadin-jandex (>=22.0.6, <=22.0.14), com.vaadin:vaadin-platform-javadoc (>=22.0.6, <=22.0.14) potentially affected by CVE-2022-29567 via com.vaadin:vaadin (>=22.0.6, <=22.0.14)

com.vaadin:vaadin MAVEN version =22.0.6, =22.0.6, =22.0.6, =22.0.14 Source cves: CVE-2022-29567 Source advisory: OSV:GHSA-QFR3-323W-QV27...

com.vaadin:vaadin (>=22.0.6, <=22.0.14), com.vaadin:vaadin-core (>=22.0.6, <=22.0.14) +9 more potentially affected by CVE-2022-29567 via com.vaadin:vaadin-grid-flow (>=22.0.6, <=22.0.14)

com.vaadin:vaadin-grid-flow MAVEN version =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.14 Source cves: CVE-2022-29567 Source advisory: MEND:CVE-2022-29567...

com.holon-platform.artisan:holon-artisan-demo (>=2.2.4, <=2.2.6), com.holon-platform.artisan:holon-artisan-vaadin-flow-app-layout (>=2.2.4, <=2.2.6) +88 more potentially affected by CVE-2022-29567 via com.vaadin:vaadin-grid-flow (>=14.8.5, <=14.8.9)

com.vaadin:vaadin-grid-flow MAVEN version =14.8.5, =2.2.4, =2.2.4, =2.2.4, =2.2.4, =14.8.5, =14.8.5, =14.8.5, =14.8.9 and more Source cves: CVE-2022-29567 Source advisory: MEND:CVE-2022-29567...

CVE-2022-29567

The CVE-2022-29567 vulnerability concerns the default configuration of the TreeGrid component in Vaadin. Affected installations are those using Vaadin versions 14.8.5–14.8.9, 22.0.6–22.0.14, 23.0.0.beta2–23.0.8, and 23.1.0.alpha1–23.1.0.alpha4. The issue arises because Object::toString is used as...

CVE-2022-29567 Possible information disclosure inside TreeGrid component with default data provider

The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure ...