Read the docs
TI-2023-10808 Aliases CVE-2023-25500GHSA-ch48-9r3q-pv7x

Information disclosure in vaadin

Priority LOW 21CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00514 44th percentileScored 2026-11-07
Fix Fixed com.vaadin:flow-server (Maven): 1.0.21, 2.9.3, 9.1.2 +3com.vaadin:vaadin (Maven): 10.0.24, 14.10.2, 22.1.0 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Vaadinvaadin10.0.0 – 10.0.23; 11.0.0 – 14.10.1; 15.0.0 – 22.0.28; 23.0.0 – 23.3.13; 24.0.0 – 24.0.6; 24.1.0.alpha1 – 24.1.0.rc2—No fix listedCNA
Flowflow-server1.0.0 – 1.0.20; 1.1.0 – 2.9.2; 3.0.0 – 9.1.1; 23.0.0 – 23.3.12; 24.0.0 – 24.0.8; 24.1.0.alpha1 – 24.1.0.rc3—No fix listedCNA
—com.vaadin:flow-server (Maven)1.0.0 to before 1.0.211.0.21Patch availableGHSA-ch48-9r3q-pv7x
—com.vaadin:flow-server (Maven)1.1.0 to before 2.9.32.9.3Patch availableGHSA-ch48-9r3q-pv7x
—com.vaadin:flow-server (Maven)3.0.0 to before 9.1.29.1.2Patch availableGHSA-ch48-9r3q-pv7x
—com.vaadin:flow-server (Maven)23.0.0 to before 23.3.1323.3.13Patch availableGHSA-ch48-9r3q-pv7x
—com.vaadin:flow-server (Maven)24.0.0 to before 24.0.924.0.9Patch availableGHSA-ch48-9r3q-pv7x
—com.vaadin:flow-server (Maven)24.1.alpha1 to before 24.1.024.1.0Patch availableGHSA-ch48-9r3q-pv7x
—com.vaadin:vaadin (Maven)10.0.0 to before 10.0.2410.0.24Patch availableGHSA-ch48-9r3q-pv7x
—com.vaadin:vaadin (Maven)11.0.0 to before 14.10.214.10.2Patch availableGHSA-ch48-9r3q-pv7x
—com.vaadin:vaadin (Maven)15.0.0 to before 22.1.022.1.0Patch availableGHSA-ch48-9r3q-pv7x
—com.vaadin:vaadin (Maven)23.0.0 to before 23.3.1423.3.14Patch availableGHSA-ch48-9r3q-pv7x
—com.vaadin:vaadin (Maven)24.0.0 to before 24.0.724.0.7Patch availableGHSA-ch48-9r3q-pv7x
—com.vaadin:vaadin (Maven)24.1.0.alpha1 to before 24.1.024.1.0Patch availableGHSA-ch48-9r3q-pv7x
  • vaadin VendorVaadin Affected 10.0.0 – 10.0.23; 11.0.0 – 14.10.1; 15.0.0 – 22.0.28; 23.0.0 – 23.3.13; 24.0.0 – 24.0.6; 24.1.0.alpha1 – 24.1.0.rc2 Fixed in — No fix listed CNA
  • flow-server VendorFlow Affected 1.0.0 – 1.0.20; 1.1.0 – 2.9.2; 3.0.0 – 9.1.1; 23.0.0 – 23.3.12; 24.0.0 – 24.0.8; 24.1.0.alpha1 – 24.1.0.rc3 Fixed in — No fix listed CNA
  • com.vaadin:flow-server (Maven) Vendor— Affected 1.0.0 to before 1.0.21 Fixed in 1.0.21 Patch available GHSA-ch48-9r3q-pv7x
  • com.vaadin:flow-server (Maven) Vendor— Affected 1.1.0 to before 2.9.3 Fixed in 2.9.3 Patch available GHSA-ch48-9r3q-pv7x
  • com.vaadin:flow-server (Maven) Vendor— Affected 3.0.0 to before 9.1.2 Fixed in 9.1.2 Patch available GHSA-ch48-9r3q-pv7x
  • com.vaadin:flow-server (Maven) Vendor— Affected 23.0.0 to before 23.3.13 Fixed in 23.3.13 Patch available GHSA-ch48-9r3q-pv7x
  • com.vaadin:flow-server (Maven) Vendor— Affected 24.0.0 to before 24.0.9 Fixed in 24.0.9 Patch available GHSA-ch48-9r3q-pv7x
  • com.vaadin:flow-server (Maven) Vendor— Affected 24.1.alpha1 to before 24.1.0 Fixed in 24.1.0 Patch available GHSA-ch48-9r3q-pv7x
  • com.vaadin:vaadin (Maven) Vendor— Affected 10.0.0 to before 10.0.24 Fixed in 10.0.24 Patch available GHSA-ch48-9r3q-pv7x
  • com.vaadin:vaadin (Maven) Vendor— Affected 11.0.0 to before 14.10.2 Fixed in 14.10.2 Patch available GHSA-ch48-9r3q-pv7x
  • com.vaadin:vaadin (Maven) Vendor— Affected 15.0.0 to before 22.1.0 Fixed in 22.1.0 Patch available GHSA-ch48-9r3q-pv7x
  • com.vaadin:vaadin (Maven) Vendor— Affected 23.0.0 to before 23.3.14 Fixed in 23.3.14 Patch available GHSA-ch48-9r3q-pv7x
  • com.vaadin:vaadin (Maven) Vendor— Affected 24.0.0 to before 24.0.7 Fixed in 24.0.7 Patch available GHSA-ch48-9r3q-pv7x
  • com.vaadin:vaadin (Maven) Vendor— Affected 24.1.0.alpha1 to before 24.1.0 Fixed in 24.1.0 Patch available GHSA-ch48-9r3q-pv7x

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*10.0.0 to before 10.0.23; 11.0.0 to before 14.10.2; 15.0.0 – 22.0.28; 23.0.0 to before 23.3.14; 24.0.0 to before 24.0.7VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:24.1.0:alpha1:*:*:*:*:*:*24.1.0 alpha1VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:24.1.0:alpha2:*:*:*:*:*:*24.1.0 alpha2VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:24.1.0:alpha3:*:*:*:*:*:*24.1.0 alpha3VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:24.1.0:alpha4:*:*:*:*:*:*24.1.0 alpha4VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:24.1.0:alpha5:*:*:*:*:*:*24.1.0 alpha5VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:24.1.0:alpha6:*:*:*:*:*:*24.1.0 alpha6VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:24.1.0:beta1:*:*:*:*:*:*24.1.0 beta1VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:24.1.0:beta2:*:*:*:*:*:*24.1.0 beta2VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:24.1.0:beta3:*:*:*:*:*:*24.1.0 beta3VulnerableVaadin
  • cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 10.0.0 to before 10.0.23; 11.0.0 to before 14.10.2; 15.0.0 – 22.0.28; 23.0.0 to before 23.3.14; 24.0.0 to before 24.0.7 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:alpha1:*:*:*:*:*:* Versions 24.1.0 alpha1 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:alpha2:*:*:*:*:*:* Versions 24.1.0 alpha2 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:alpha3:*:*:*:*:*:* Versions 24.1.0 alpha3 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:alpha4:*:*:*:*:*:* Versions 24.1.0 alpha4 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:alpha5:*:*:*:*:*:* Versions 24.1.0 alpha5 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:alpha6:*:*:*:*:*:* Versions 24.1.0 alpha6 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:beta1:*:*:*:*:*:* Versions 24.1.0 beta1 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:beta2:*:*:*:*:*:* Versions 24.1.0 beta2 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:beta3:*:*:*:*:*:* Versions 24.1.0 beta3 Vulnerable ·Vaadin
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:vaadin:vaadin:24.1.0:rc1:*:*:*:*:*:*24.1.0 rc1VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:24.1.0:rc2:*:*:*:*:*:*24.1.0 rc2VulnerableVaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:rc1:*:*:*:*:*:* Versions 24.1.0 rc1 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:24.1.0:rc2:*:*:*:*:*:* Versions 24.1.0 rc2 Vulnerable ·Vaadin

Remediation

  • Fix · GHSA-ch48-9r3q-pv7x com.vaadin:flow-server (Maven) Fixed in 1.0.21 Advisory →
  • Fix · GHSA-ch48-9r3q-pv7x com.vaadin:flow-server (Maven) Fixed in 2.9.3 Advisory →
  • Fix · GHSA-ch48-9r3q-pv7x com.vaadin:flow-server (Maven) Fixed in 9.1.2 Advisory →
  • Fix · GHSA-ch48-9r3q-pv7x com.vaadin:flow-server (Maven) Fixed in 23.3.13 Advisory →
  • Fix · GHSA-ch48-9r3q-pv7x com.vaadin:flow-server (Maven) Fixed in 24.0.9 Advisory →
  • Fix · GHSA-ch48-9r3q-pv7x com.vaadin:flow-server (Maven) Fixed in 24.1.0 Advisory →
  • Fix · GHSA-ch48-9r3q-pv7x com.vaadin:vaadin (Maven) Fixed in 10.0.24 Advisory →
  • Fix · GHSA-ch48-9r3q-pv7x com.vaadin:vaadin (Maven) Fixed in 14.10.2 Advisory →
  • Fix · GHSA-ch48-9r3q-pv7x com.vaadin:vaadin (Maven) Fixed in 22.1.0 Advisory →
  • Fix · GHSA-ch48-9r3q-pv7x com.vaadin:vaadin (Maven) Fixed in 23.3.14 Advisory →
  • Fix · GHSA-ch48-9r3q-pv7x com.vaadin:vaadin (Maven) Fixed in 24.0.7 Advisory →
  • Fix · GHSA-ch48-9r3q-pv7x com.vaadin:vaadin (Maven) Fixed in 24.1.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-25500
  2. 2026-10-03 Alias added: GHSA-ch48-9r3q-pv7x

References

Patch 1

Advisory 2

Other 2

  • TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
  • TI-2020-18603 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 CVSS 3.1HIGH 7.5
  • TI-2021-11541 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVSS 3.1HIGH 7.5
  • TI-2022-12014 Possible information disclosure inside TreeGrid component with default data provider CVSS 3.1HIGH 7.5
  • TI-2021-11537 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
  • TI-2020-18604 Directory traversal in development mode handler in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences