CVE-2023-25500 Vaadin vulnerable to possible information disclosure of class and method names in RPC response
Attackers can disclose internal class and method names by sending modified RPC requests to Vaadin applications, potentially aiding further attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-25500?
CVE-2023-25500 is a low-severity vulnerability in flow-server, published on 22 Jun 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.
Weakness: CWE-200
Which versions are affected by CVE-2023-25500?
24 open source packages ship an affected version, including com.vaadin:flow-server and com.vaadin:vaadin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.vaadin:flow-server Maven | From 1.0.0 | 1.0.21 |
com.vaadin:flow-server Maven | From 1.0.0 | 1.0.21 |
com.vaadin:flow-server Maven | From 1.1.0 | 2.9.3 |
com.vaadin:flow-server Maven | From 1.1.0 | 2.9.3 |
com.vaadin:flow-server Maven | From 23.0.0 | 23.3.13 |
com.vaadin:flow-server Maven | From 23.0.0 | 23.3.13 |
18 more packages
com.vaadin:flow-server Maven | From 24.0.0 | 24.0.9 |
com.vaadin:flow-server Maven | From 24.0.0 | 24.0.9 |
com.vaadin:flow-server Maven | From 24.1.alpha1 | 24.1.0 |
com.vaadin:flow-server Maven | From 24.1.alpha1 | 24.1.0 |
com.vaadin:flow-server Maven | From 3.0.0 | 9.1.2 |
com.vaadin:flow-server Maven | From 3.0.0 | 9.1.2 |
com.vaadin:vaadin Maven | From 10.0.0 | 10.0.24 |
com.vaadin:vaadin Maven | From 10.0.0 | 10.0.24 |
com.vaadin:vaadin Maven | From 11.0.0 | 14.10.2 |
com.vaadin:vaadin Maven | From 11.0.0 | 14.10.2 |
com.vaadin:vaadin Maven | From 15.0.0 | 22.1.0 |
com.vaadin:vaadin Maven | From 15.0.0 | 22.1.0 |
com.vaadin:vaadin Maven | From 23.0.0 | 23.3.14 |
com.vaadin:vaadin Maven | From 23.0.0 | 23.3.14 |
com.vaadin:vaadin Maven | From 24.0.0 | 24.0.7 |
com.vaadin:vaadin Maven | From 24.0.0 | 24.0.7 |
com.vaadin:vaadin Maven | From 24.1.0.alpha1 | 24.1.0 |
com.vaadin:vaadin Maven | From 24.1.0.alpha1 | 24.1.0 |
Products include Vaadin Vaadin.
How do I fix CVE-2023-25500?
Upgrade com.vaadin:flow-server to a fixed version for your release line: 1.0.21, 2.9.3, 23.3.13 or 24.0.9.
Is CVE-2023-25500 being exploited?
There is no known exploitation of CVE-2023-25500 in the wild and no public exploit code.
Other vulnerabilities in flow-server
- CVE-2021-31409 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
- CVE-2020-36320 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7
- CVE-2021-33611 Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14
- CVE-2023-25499 Possible information disclosure in non visible components
- CVE-2022-29567 Possible information disclosure inside TreeGrid component with default data provider
Sources
Also known as GHSA-ch48-9r3q-pv7x.