Read the docs
TI-2023-10807 Aliases CVE-2023-25499GHSA-5f9v-mv5g-jh5q

Possible information disclosure in non visible components

Priority LOW 30CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0058 47th percentileScored 2026-11-07
Fix Fixed flow-server (vaadin): 2.9.1com.vaadin:vaadin (Maven): 10.0.23, 14.10.1, 23.3.13 +2+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Vaadinvaadin10.0.0 – 10.0.22; 11.0.0 – 14.10.0; 15.0.0 – 22.0.28; 23.0.0 – 23.3.12; 24.0.0 – 24.0.5; 24.1.0.alpha1 – 24.1.0.beta1—No fix listedCNA
Vaadinflow-server1.0.0 – 1.0.19; 1.1.0 – 2.8.9; 2.9.0 to before 2.9.1; 3.0.0 – 9.1.0; 23.0.0 – 23.3.10; 24.0.0 – 24.0.7; 24.1.0.alpha1 – 24.1.0.beta12.9.1Patch availableCNA
—com.vaadin:vaadin (Maven)10.0.0 to before 10.0.2310.0.23Patch availableGHSA-5f9v-mv5g-jh5q
—com.vaadin:vaadin (Maven)11.0.0 to before 14.10.114.10.1Patch availableGHSA-5f9v-mv5g-jh5q
—com.vaadin:vaadin (Maven)23.0.0 to before 23.3.1323.3.13Patch availableGHSA-5f9v-mv5g-jh5q
—com.vaadin:vaadin (Maven)24.0.0 to before 24.0.624.0.6Patch availableGHSA-5f9v-mv5g-jh5q
—com.vaadin:vaadin (Maven)24.1.0.alpha1 to before 24.1.024.1.0Patch availableGHSA-5f9v-mv5g-jh5q
—com.vaadin:flow-server (Maven)1.0.0 to before 1.0.201.0.20Patch availableGHSA-5f9v-mv5g-jh5q
—com.vaadin:flow-server (Maven)1.1.0 to before 2.8.102.8.10Patch availableGHSA-5f9v-mv5g-jh5q
—com.vaadin:flow-server (Maven)3.0.0 to before 9.1.19.1.1Patch availableGHSA-5f9v-mv5g-jh5q
—com.vaadin:flow-server (Maven)23.0.0 to before 23.3.1123.3.11Patch availableGHSA-5f9v-mv5g-jh5q
—com.vaadin:flow-server (Maven)24.0.0 to before 24.0.824.0.8Patch availableGHSA-5f9v-mv5g-jh5q
—com.vaadin:flow-server (Maven)24.1.0.alpha1 to before 24.1.024.1.0Patch availableGHSA-5f9v-mv5g-jh5q
  • vaadin VendorVaadin Affected 10.0.0 – 10.0.22; 11.0.0 – 14.10.0; 15.0.0 – 22.0.28; 23.0.0 – 23.3.12; 24.0.0 – 24.0.5; 24.1.0.alpha1 – 24.1.0.beta1 Fixed in — No fix listed CNA
  • flow-server VendorVaadin Affected 1.0.0 – 1.0.19; 1.1.0 – 2.8.9; 2.9.0 to before 2.9.1; 3.0.0 – 9.1.0; 23.0.0 – 23.3.10; 24.0.0 – 24.0.7; 24.1.0.alpha1 – 24.1.0.beta1 Fixed in 2.9.1 Patch available CNA
  • com.vaadin:vaadin (Maven) Vendor— Affected 10.0.0 to before 10.0.23 Fixed in 10.0.23 Patch available GHSA-5f9v-mv5g-jh5q
  • com.vaadin:vaadin (Maven) Vendor— Affected 11.0.0 to before 14.10.1 Fixed in 14.10.1 Patch available GHSA-5f9v-mv5g-jh5q
  • com.vaadin:vaadin (Maven) Vendor— Affected 23.0.0 to before 23.3.13 Fixed in 23.3.13 Patch available GHSA-5f9v-mv5g-jh5q
  • com.vaadin:vaadin (Maven) Vendor— Affected 24.0.0 to before 24.0.6 Fixed in 24.0.6 Patch available GHSA-5f9v-mv5g-jh5q
  • com.vaadin:vaadin (Maven) Vendor— Affected 24.1.0.alpha1 to before 24.1.0 Fixed in 24.1.0 Patch available GHSA-5f9v-mv5g-jh5q
  • com.vaadin:flow-server (Maven) Vendor— Affected 1.0.0 to before 1.0.20 Fixed in 1.0.20 Patch available GHSA-5f9v-mv5g-jh5q
  • com.vaadin:flow-server (Maven) Vendor— Affected 1.1.0 to before 2.8.10 Fixed in 2.8.10 Patch available GHSA-5f9v-mv5g-jh5q
  • com.vaadin:flow-server (Maven) Vendor— Affected 3.0.0 to before 9.1.1 Fixed in 9.1.1 Patch available GHSA-5f9v-mv5g-jh5q
  • com.vaadin:flow-server (Maven) Vendor— Affected 23.0.0 to before 23.3.11 Fixed in 23.3.11 Patch available GHSA-5f9v-mv5g-jh5q
  • com.vaadin:flow-server (Maven) Vendor— Affected 24.0.0 to before 24.0.8 Fixed in 24.0.8 Patch available GHSA-5f9v-mv5g-jh5q
  • com.vaadin:flow-server (Maven) Vendor— Affected 24.1.0.alpha1 to before 24.1.0 Fixed in 24.1.0 Patch available GHSA-5f9v-mv5g-jh5q

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*10.0.0 to before 10.0.23; 11.0.0 to before 14.10.1; 15.0.0 – 22.0.28; 23.0.0 to before 23.3.13; 24.0.0 to before 24.0.6VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:24.1.0:alpha1:*:*:*:*:*:*24.1.0 alpha1VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:24.1.0:alpha2:*:*:*:*:*:*24.1.0 alpha2VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:24.1.0:alpha3:*:*:*:*:*:*24.1.0 alpha3VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:24.1.0:alpha4:*:*:*:*:*:*24.1.0 alpha4VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:24.1.0:alpha5:*:*:*:*:*:*24.1.0 alpha5VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:24.1.0:alpha6:*:*:*:*:*:*24.1.0 alpha6VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:24.1.0:beta1:*:*:*:*:*:*24.1.0 beta1VulnerableVaadin
  • cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 10.0.0 to before 10.0.23; 11.0.0 to before 14.10.1; 15.0.0 – 22.0.28; 23.0.0 to before 23.3.13; 24.0.0 to before 24.0.6 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:alpha1:*:*:*:*:*:* Versions 24.1.0 alpha1 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:alpha2:*:*:*:*:*:* Versions 24.1.0 alpha2 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:alpha3:*:*:*:*:*:* Versions 24.1.0 alpha3 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:alpha4:*:*:*:*:*:* Versions 24.1.0 alpha4 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:alpha5:*:*:*:*:*:* Versions 24.1.0 alpha5 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:alpha6:*:*:*:*:*:* Versions 24.1.0 alpha6 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:beta1:*:*:*:*:*:* Versions 24.1.0 beta1 Vulnerable ·Vaadin

Remediation

  • Fix · CNA flow-server (vaadin) Fixed in 2.9.1
  • Fix · GHSA-5f9v-mv5g-jh5q com.vaadin:vaadin (Maven) Fixed in 10.0.23 Advisory →
  • Fix · GHSA-5f9v-mv5g-jh5q com.vaadin:vaadin (Maven) Fixed in 14.10.1 Advisory →
  • Fix · GHSA-5f9v-mv5g-jh5q com.vaadin:vaadin (Maven) Fixed in 23.3.13 Advisory →
  • Fix · GHSA-5f9v-mv5g-jh5q com.vaadin:vaadin (Maven) Fixed in 24.0.6 Advisory →
  • Fix · GHSA-5f9v-mv5g-jh5q com.vaadin:vaadin (Maven) Fixed in 24.1.0 Advisory →
  • Fix · GHSA-5f9v-mv5g-jh5q com.vaadin:flow-server (Maven) Fixed in 1.0.20 Advisory →
  • Fix · GHSA-5f9v-mv5g-jh5q com.vaadin:flow-server (Maven) Fixed in 2.8.10 Advisory →
  • Fix · GHSA-5f9v-mv5g-jh5q com.vaadin:flow-server (Maven) Fixed in 9.1.1 Advisory →
  • Fix · GHSA-5f9v-mv5g-jh5q com.vaadin:flow-server (Maven) Fixed in 23.3.11 Advisory →
  • Fix · GHSA-5f9v-mv5g-jh5q com.vaadin:flow-server (Maven) Fixed in 24.0.8 Advisory →
  • Fix · GHSA-5f9v-mv5g-jh5q com.vaadin:flow-server (Maven) Fixed in 24.1.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-25499
  2. 2026-10-03 Alias added: GHSA-5f9v-mv5g-jh5q

References

Patch 1

Advisory 2

Other 2

  • TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
  • TI-2020-18603 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 CVSS 3.1HIGH 7.5
  • TI-2021-11541 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVSS 3.1HIGH 7.5
  • TI-2022-12014 Possible information disclosure inside TreeGrid component with default data provider CVSS 3.1HIGH 7.5
  • TI-2021-11537 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
  • TI-2020-18604 Directory traversal in development mode handler in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences