Information Disclosure

🗓️ 29 Jun 2023 09:21:56Reported by Veracode Vulnerability DatabaseType

Vaadin Information Disclosure vulnerability due to unmasked sensitive debug messages in RPC responses

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2023-25500	28 Jan 202400:20	–	circl
CNNVD	Vaadin 信息泄露漏洞	22 Jun 202300:00	–	cnnvd
CVE	CVE-2023-25500	22 Jun 202312:49	–	cve
Cvelist	CVE-2023-25500	22 Jun 202312:49	–	cvelist
EUVD	EUVD-2023-1775	3 Oct 202520:07	–	euvd
Github Security Blog	Vaadin vulnerable to possible information disclosure of class and method names in RPC response	22 Jun 202320:01	–	github
NVD	CVE-2023-25500	22 Jun 202313:15	–	nvd
OSV	CVE-2023-25500	22 Jun 202313:15	–	osv
OSV	GHSA-CH48-9R3Q-PV7X Vaadin vulnerable to possible information disclosure of class and method names in RPC response	22 Jun 202320:01	–	osv
Prion	Information disclosure	22 Jun 202313:15	–	prion

Vulners

Node

vaadin flow-serverRange1.0.0–1.0.20java

vaadin flow-serverRange1.1.0–2.9.2java

vaadin flow-serverRange3.0.0–9.1.1java

vaadin flow-serverRange23.0.0–23.3.12java

vaadin flow-serverRange24.0.0–24.0.8java

Source	Link
github	www.github.com/vaadin/flow/pull/16935
vaadin	www.vaadin.com/security/CVE-2023-25500
github	www.github.com/vaadin/flow/commit/6dbb2da232146cc2be503b75f3cf1325bee11586
github	www.github.com/vaadin/flow/commit/1814087ba77cd9946fe12b4d4d5fc136c6f943df
github	www.github.com/vaadin/flow/commit/2b81a152d8e2b956e96fac966b53acbdce9057e7
github	www.github.com/vaadin/flow/commit/1717a07c56d8cb7887a61e4dc7eae2a4597d4988
github	www.github.com/vaadin/flow/commit/4ddc1a901a4c84853b5c7aa025a3cd6545f1f66e
github	www.github.com/vaadin/flow/commit/1814087ba77cd9946fe12b4d4d5fc136c6f943df
github	www.github.com/vaadin/flow/commit/402388840e575c0b5fbcdde037ebdc7317035d43

30 Jun 2023 18:46Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.13.5 - 4.3

EPSS0.00305

SSVC