Possible information disclosure inside TreeGrid component with default data provider
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 23.1.0.beta1, 14.8.10, 22.0.15, 23.0.9
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.
Timeline
- CVE published
- Record last updated
Affected versions
- com.vaadin:vaadin
From 14.8.5 · through 14.8.9; From 22.0.6 · through 22.0.14; From 23.0.0.beta2 · through 23.0.8; From 23.1.0.alpha1 · fixed in 23.1.0.beta1
- com.vaadin:vaadin-grid-flow
From 14.8.5 · through 14.8.9; From 22.0.6 · through 22.0.14; From 23.0.0.beta2 · through 23.0.8; From 23.1.0.alpha1 · fixed in 23.1.0.beta1
- com.vaadin:vaadinMaven
From 14.8.5 · fixed in 14.8.10
- com.vaadin:vaadinMaven
From 22.0.6 · fixed in 22.0.15
- com.vaadin:vaadinMaven
From 23.0.0 · fixed in 23.0.9
- com.vaadin:vaadin-grid-flowMaven
From 14.8.5 · fixed in 14.8.10
- com.vaadin:vaadin-grid-flowMaven
From 22.0.6 · fixed in 22.0.15
- com.vaadin:vaadin-grid-flowMaven
From 23.0.0.beta2 · fixed in 23.0.9