CVE-2023-25499 Possible information disclosure in non visible components

What is CVE-2023-25499?

CVE-2023-25499 is a medium-severity vulnerability in vaadin flow-server, published on 22 Jun 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.

Weakness: CWE-200

Which versions are affected by CVE-2023-25499?

22 open source packages ship an affected version, including com.vaadin:flow-server and com.vaadin:vaadin. It affects 1 product.

Products include Vaadin Vaadin.

How do I fix CVE-2023-25499?

Upgrade com.vaadin:flow-server to a fixed version for your release line: 1.0.20, 2.8.10, 23.3.11 or 24.0.8.

Is CVE-2023-25499 being exploited?

There is no known exploitation of CVE-2023-25499 in the wild and no public exploit code.

Other vulnerabilities in vaadin flow-server

• CVE-2021-31409 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 High 7.5
• CVE-2020-36320 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 High 7.5
• CVE-2021-33611 Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14 Medium 6.1
• CVE-2022-29567 Possible information disclosure inside TreeGrid component with default data provider Medium 5.7
• CVE-2019-25028 Stored cross-site scripting in Grid component in Vaadin 7 and 8 Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5f9v-mv5g-jh5q.