CVE-2023-25499: Exposure of Sensitive Information to an Unauthorized Actor

June 22, 2023 (updated June 30, 2023)

When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.

References

github.com/vaadin/flow/pull/15885
nvd.nist.gov/vuln/detail/CVE-2023-25499
vaadin.com/security/CVE-2023-25499

Code Behaviors & Features

Detect and mitigate CVE-2023-25499 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →