Possible information disclosure inside TreeGrid component with default data provider
Priority LOW 35CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.
Why it matters now
EPSS 0.01002 63rd percentileScored 2026-11-07
Fix Fixed vaadin (Vaadin): 23.1.0.beta1vaadin-grid-flow (Vaadin): 23.1.0.beta1+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Vaadin | vaadin | 14.8.5 – 14.8.9; 22.0.6 – 22.0.14; 23.0.0.beta2 – 23.0.8; 23.1.0.alpha1 to before 23.1.0.beta1 | 23.1.0.beta1 | Patch available | CNA |
| Vaadin | vaadin-grid-flow | 14.8.5 – 14.8.9; 22.0.6 – 22.0.14; 23.0.0.beta2 – 23.0.8; 23.1.0.alpha1 to before 23.1.0.beta1 | 23.1.0.beta1 | Patch available | CNA |
| — | com.vaadin:vaadin (Maven) | 14.8.5 to before 14.8.10 | 14.8.10 | Patch available | GHSA-qfr3-323w-qv27 |
| — | com.vaadin:vaadin (Maven) | 22.0.6 to before 22.0.15 | 22.0.15 | Patch available | GHSA-qfr3-323w-qv27 |
| — | com.vaadin:vaadin (Maven) | 23.0.0 to before 23.0.9 | 23.0.9 | Patch available | GHSA-qfr3-323w-qv27 |
| — | com.vaadin:vaadin-grid-flow (Maven) | 14.8.5 to before 14.8.10 | 14.8.10 | Patch available | GHSA-qfr3-323w-qv27 |
| — | com.vaadin:vaadin-grid-flow (Maven) | 22.0.6 to before 22.0.15 | 22.0.15 | Patch available | GHSA-qfr3-323w-qv27 |
| — | com.vaadin:vaadin-grid-flow (Maven) | 23.0.0.beta2 to before 23.0.9 | 23.0.9 | Patch available | GHSA-qfr3-323w-qv27 |
- vaadin VendorVaadin Affected 14.8.5 – 14.8.9; 22.0.6 – 22.0.14; 23.0.0.beta2 – 23.0.8; 23.1.0.alpha1 to before 23.1.0.beta1 Fixed in 23.1.0.beta1 Patch available CNA
- vaadin-grid-flow VendorVaadin Affected 14.8.5 – 14.8.9; 22.0.6 – 22.0.14; 23.0.0.beta2 – 23.0.8; 23.1.0.alpha1 to before 23.1.0.beta1 Fixed in 23.1.0.beta1 Patch available CNA
- com.vaadin:vaadin (Maven) Vendor— Affected 14.8.5 to before 14.8.10 Fixed in 14.8.10 Patch available GHSA-qfr3-323w-qv27
- com.vaadin:vaadin (Maven) Vendor— Affected 22.0.6 to before 22.0.15 Fixed in 22.0.15 Patch available GHSA-qfr3-323w-qv27
- com.vaadin:vaadin (Maven) Vendor— Affected 23.0.0 to before 23.0.9 Fixed in 23.0.9 Patch available GHSA-qfr3-323w-qv27
- com.vaadin:vaadin-grid-flow (Maven) Vendor— Affected 14.8.5 to before 14.8.10 Fixed in 14.8.10 Patch available GHSA-qfr3-323w-qv27
- com.vaadin:vaadin-grid-flow (Maven) Vendor— Affected 22.0.6 to before 22.0.15 Fixed in 22.0.15 Patch available GHSA-qfr3-323w-qv27
- com.vaadin:vaadin-grid-flow (Maven) Vendor— Affected 23.0.0.beta2 to before 23.0.9 Fixed in 23.0.9 Patch available GHSA-qfr3-323w-qv27
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* | 14.8.5 – 14.8.9; 22.0.6 – 22.0.15; 23.0.1 – 23.0.8 | Vulnerable | Vaadin |
| cpe:2.3:a:vaadin:vaadin:23.0.0:-:*:*:*:*:*:* | 23.0.0 | Vulnerable | Vaadin |
| cpe:2.3:a:vaadin:vaadin:23.0.0:beta2:*:*:*:*:*:* | 23.0.0 beta2 | Vulnerable | Vaadin |
| cpe:2.3:a:vaadin:vaadin:23.0.0:beta3:*:*:*:*:*:* | 23.0.0 beta3 | Vulnerable | Vaadin |
| cpe:2.3:a:vaadin:vaadin:23.0.0:beta4:*:*:*:*:*:* | 23.0.0 beta4 | Vulnerable | Vaadin |
| cpe:2.3:a:vaadin:vaadin:23.0.0:rc1:*:*:*:*:*:* | 23.0.0 rc1 | Vulnerable | Vaadin |
| cpe:2.3:a:vaadin:vaadin:23.1.0:alpha1:*:*:*:*:*:* | 23.1.0 alpha1 | Vulnerable | Vaadin |
| cpe:2.3:a:vaadin:vaadin:23.1.0:alpha2:*:*:*:*:*:* | 23.1.0 alpha2 | Vulnerable | Vaadin |
| cpe:2.3:a:vaadin:vaadin:23.1.0:alpha3:*:*:*:*:*:* | 23.1.0 alpha3 | Vulnerable | Vaadin |
| cpe:2.3:a:vaadin:vaadin:23.1.0:alpha4:*:*:*:*:*:* | 23.1.0 alpha4 | Vulnerable | Vaadin |
- cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 14.8.5 – 14.8.9; 22.0.6 – 22.0.15; 23.0.1 – 23.0.8 Vulnerable ·Vaadin
- cpe:2.3:a:vaadin:vaadin:23.0.0:-:*:*:*:*:*:* Versions 23.0.0 Vulnerable ·Vaadin
- cpe:2.3:a:vaadin:vaadin:23.0.0:beta2:*:*:*:*:*:* Versions 23.0.0 beta2 Vulnerable ·Vaadin
- cpe:2.3:a:vaadin:vaadin:23.0.0:beta3:*:*:*:*:*:* Versions 23.0.0 beta3 Vulnerable ·Vaadin
- cpe:2.3:a:vaadin:vaadin:23.0.0:beta4:*:*:*:*:*:* Versions 23.0.0 beta4 Vulnerable ·Vaadin
- cpe:2.3:a:vaadin:vaadin:23.0.0:rc1:*:*:*:*:*:* Versions 23.0.0 rc1 Vulnerable ·Vaadin
- cpe:2.3:a:vaadin:vaadin:23.1.0:alpha1:*:*:*:*:*:* Versions 23.1.0 alpha1 Vulnerable ·Vaadin
- cpe:2.3:a:vaadin:vaadin:23.1.0:alpha2:*:*:*:*:*:* Versions 23.1.0 alpha2 Vulnerable ·Vaadin
- cpe:2.3:a:vaadin:vaadin:23.1.0:alpha3:*:*:*:*:*:* Versions 23.1.0 alpha3 Vulnerable ·Vaadin
- cpe:2.3:a:vaadin:vaadin:23.1.0:alpha4:*:*:*:*:*:* Versions 23.1.0 alpha4 Vulnerable ·Vaadin
Remediation
- Fix · CNA vaadin (Vaadin) Fixed in 23.1.0.beta1
- Fix · CNA vaadin-grid-flow (Vaadin) Fixed in 23.1.0.beta1
- Fix · GHSA-qfr3-323w-qv27 com.vaadin:vaadin (Maven) Fixed in 14.8.10 Advisory →
- Fix · GHSA-qfr3-323w-qv27 com.vaadin:vaadin (Maven) Fixed in 22.0.15 Advisory →
- Fix · GHSA-qfr3-323w-qv27 com.vaadin:vaadin (Maven) Fixed in 23.0.9 Advisory →
- Fix · GHSA-qfr3-323w-qv27 com.vaadin:vaadin-grid-flow (Maven) Fixed in 14.8.10 Advisory →
- Fix · GHSA-qfr3-323w-qv27 com.vaadin:vaadin-grid-flow (Maven) Fixed in 22.0.15 Advisory →
- Fix · GHSA-qfr3-323w-qv27 com.vaadin:vaadin-grid-flow (Maven) Fixed in 23.0.9 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-29567
- 2026-10-03 Alias added: GHSA-qfr3-323w-qv27
References
More Vaadin vulnerabilities
- TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
- TI-2020-18603 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 CVSS 3.1HIGH 7.5
- TI-2021-11541 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVSS 3.1HIGH 7.5
- TI-2021-11537 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
- TI-2020-18604 Directory traversal in development mode handler in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
- TI-2021-11543 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 CVSS 3.1HIGH 7.8
Sources
- CVE-2022-29567 · CVE Program
- CVE-2022-29567 · NVD
- FIRST EPSS
- GHSA-qfr3-323w-qv27 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences