CVE-2023-25499: Vaadin Vulnerable to Information Disclosure in Non-Visible Components
Summary
CVE-2023-25499: Vaadin vulnerable to possible information disclosure in non visible components. Affects com.vaadin:vaadin across 5 version ranges.
>= 10.0.0, < 10.0.23
>= 11.0.0, < 14.10.1
>= 23.0.0, < 23.3.13
>= 24.0.0, < 24.0.6
>= 24.1.0.alpha1, < 24.1.0
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vaadin is an open-source Java framework used for building modern web applications. It provides a set of user interface components and tools for creating responsive and interactive UIs. Vaadin allows developers to build web applications using Java on the server-side, which is then rendered on the client-side. It is widely used for developing enterprise-level applications due to its robustness and scalability. However, Vaadin versions 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5, and 24.1.0.alpha1 to 24.1.0.beta1 are vulnerable to a potential information disclosure in non-visible components.
Vulnerability Detail
The vulnerability in Vaadin occurs when non-visible components are added to the user interface (UI) on the server-side. In these cases, the content of the non-visible components is still sent to the browser, potentially exposing sensitive information. This vulnerability can lead to information disclosure, allowing attackers to access data that should not be visible to them. The impact of this vulnerability depends on the nature of the information being exposed and the specific application using Vaadin. It is important to address this vulnerability to prevent unauthorized access to sensitive data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 10.0.0, < 10.0.2310.0.23 -
>= 11.0.0, < 14.10.114.10.1 -
>= 23.0.0, < 23.3.1323.3.13 -
>= 24.0.0, < 24.0.624.0.6 -
>= 24.1.0.alpha1, < 24.1.024.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions of Vaadin is not immediately feasible, a possible workaround is to avoid adding non-visible components to the UI on the server-side. Instead, consider using alternative approaches or components that do not suffer from this vulnerability. For example, you can use client-side logic to handle non-visible components or modify the UI structure to minimize the risk of information disclosure.
Conclusion
The vulnerability in Vaadin that allows potential information disclosure in non-visible components can have serious consequences in terms of unauthorized access to sensitive data. It is crucial to upgrade to the fixed versions of Vaadin or apply the recommended workaround to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for com.vaadin:vaadin →
FAQ
Vaadin is an open-source Java framework for building web applications. It provides a set of user interface components and tools for creating responsive and interactive UIs.
The vulnerability in Vaadin can lead to potential information disclosure, allowing unauthorized access to sensitive data in non-visible components.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Vaadin as mentioned in the 'how_to_fix' section.
Yes, if upgrading to the fixed versions is not immediately feasible, you can consider the workaround mentioned in the 'workaround' section.
Yes, the CVSS score for this vulnerability is 5.7.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.vaadin:vaadin.
