CVE-2022-29567 Possible information disclosure inside TreeGrid component with default data provider

What is CVE-2022-29567?

CVE-2022-29567 is a medium-severity vulnerability in vaadin, published on 24 May 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.

Weakness: CWE-200

Which versions are affected by CVE-2022-29567?

12 open source packages ship an affected version, including com.vaadin:vaadin and com.vaadin:vaadin-grid-flow. It affects 1 product.

Products include Vaadin Vaadin.

How do I fix CVE-2022-29567?

Upgrade com.vaadin:vaadin to a fixed version for your release line: 14.8.10, 22.0.15 or 23.0.9.

Is CVE-2022-29567 being exploited?

There is no known exploitation of CVE-2022-29567 in the wild and no public exploit code.

Other vulnerabilities in vaadin

• CVE-2021-31409 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 High 7.5
• CVE-2020-36320 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 High 7.5
• CVE-2021-33611 Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14 Medium 6.1
• CVE-2023-25499 Possible information disclosure in non visible components Medium 5.7
• CVE-2019-25028 Stored cross-site scripting in Grid component in Vaadin 7 and 8 Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qfr3-323w-qv27.